The Cybersecurity Manager's Guide

Chapter 9. Step 6: Organize Your InfoSec Team

The preceding chapter discussed the importance of partnering with others in the company to share InfoSec responsibilities. I urged you to give parts of your job away and to place the responsibility for security on the system owners. Why does this make sense? Two reasons. The first is to enable the concept of the neighborhood watch, with the goal of getting everyone in the company to do their part. The second is that your InfoSec department is likely grossly under-resourced for the task at hand.

From my experience, all InfoSec departments have one thing in common: not enough staff or money to protect the company’s information assets from the litany of threats they face. Like the many heads of the mythical hydra, threats to security seem to multiply with each new technology. So few companies have the staff or budget to keep up with those threats and demands for InfoSec services.

We make choices about which “crisis” to handle among the many crises that pop up every day. It’s an exercise in risk management triage every day, all day. I don’t know about you, but I’ve always been under-resourced and never had the luxury of downtime or quiet time. It’s 911 all day. It’s the nature of our work. As I’ve said before, InfoSec is like a game of hockey: fast and full contact, with no bench time. It’s not a job or career for sprinters. Our jobs are marathons with no opportunities to stop or catch your breath.

So how do you hope to survive in this ...