The Cybersecurity Manager's Guide

Chapter 1. The Odds Are Against You

Before I lay out my road map for building or revisiting an information security program, let me first provide some context of the environment in which most of us work. I say most because some of us have the privilege of working in companies with great executive sponsorship. These companies greatly value InfoSec for what it provides to the company in protecting its intellectual property. They understand the value the function provides, and view InfoSec as integral to the fabric of the organization. For the rest of us, we stand on soft soil. If I’m being honest about our situation, we’re on our own when it comes to building out the InfoSec program. Neither the culture nor any executive sponsor will provide much support. The work of putting the program in place rests solely on the security leader. I liken it to pushing a boulder up a hill. The forces are against you.

The context I’m about to share has been my experience working as a security leader in various organizations. I’ve always been one to learn from others, keeping my ear tuned to the latest trends, while challenging the InfoSec industry’s accepted standard practices. Over the years, I’ve realized that most of us operate in a work environment framed by a few fundamental facts. These facts are true for the vast majority of us, except for those chosen few who work with strong executive sponsors, almost unlimited resources, and a company culture favorable to InfoSec. Here are those facts: ...