The CISO Evolution

CHAPTER 2Business Strategy Tools

Everything around you that you call life was made up by people that were no smarter than you.

And you can change it, you can influence it… Once you learn that, you'll never be the same again.

— Steve Jobs

Opportunity

Chapter 1 established foundational vocabulary and connected you to the business's scoreboard, the financial statements. The financial statements are how the outside world judges your CEO and Board of Directors. However, most employees never see complete financial statements. Even in a publicly traded company where the financial statements are readily available for download, you are unlikely to have your manager speak directly to the Annual Report, much less distribute it for your review. Instead, operators of the business focus on how to create, deliver, and capture value.

To ease into the concept of value as a black box, let's begin with an analogy. Shortly after I graduated from college, I accidentally stumbled into a penetration testing role. I loved it. Breaking stuff was fun!

A successful penetration (pen) tester must understand foundational technologies to be effective. Without knowledge of how database queries or serialization languages function, a pen tester may fail to identify a bug. Further, without understanding the functional and nonfunctional requirements of an application, coding defects will likely remain undiscovered.¹

In short, pen testers may emulate specific tactics, techniques, and procedures (TTP) to evaluate ...