Bit of an interesting tale about someone who I understand is about to be "let go" after a fairly short time as a CISO. First off, this is not a defence of the person, most people disliked them. It is more a comment on the culture and its problems. (1/?)
First off - the person didn't have the strongest security background and they did rub the security team up the wrong way (including some odd decisions). However, they were brought in to the organisation as an EXPERT over and above any internal candidates (2/?)
They were brought in because the organisation identified that it had problems across many departments and it needed a (new role) CISO to fix this. The person was engaged with a view to a "root and branches" overhaul with no baggage from previous management. (3/?)
In the early days they had unbelievable levels of support. Everyone agreed with their strategy and approach, everyone went to meetings saying they supported this deep dive into problems and everyone said how positive the outcomes would be (4/?)
Then things started to change. Just to reiterate, this person was annoying to security professionals but lets ignore that for now.
They started analysing all the controls and processes that each department had. (5/?)
They started analysing all the controls and processes that each department had. (5/?)
As you may guess, they found problems. Lots of problems. They found countless instances of people saying "we do X" while doing Oranges. This started to find its way into the "state of security" type report. (6/?)
As if by magic, all the previous supporters turned into dire enemies. People still supported the CISO to their face, but monumental amounts of effort were spent undermining them in trivial ways. Most of this was more effort than just fixing the problems. (7/?)
In a surprisingly short period of time, this soured everything for the CISO. The execs who hired them, with the promises that "we want warts and all" decided that they didn't really want to know about warts - and certainly didnt want to fix it. (8/?)
As a result, after a surprisingly short period of time, the CISO was "let go." Some people in security were OK with this because the CISO was unpopular. But this overlooks the real problem. (9/?)
Culturally this was an organisation with so many vested/legacy interest groups that any attempt to correct past mistakes was met with overwhelming resistance. Not one senior manager was prepared to accept responsibility for improving. (10/?)
They consciously and deliberately opted to bury the message (and the messenger). They wanted to keep reporting to the Board that all was well and, as a result, underfund any improvements. (11/?)
But an even worse problem was the senior leadership who brought the CISO in. They clearly lied about their goals and expected to simply get a box ticket. When an issue appeared, leadership vanished and they silenced the troublemaker. (12/?)
The end result was that (for the nth time in recent years) and organisation had a brief opportunity for great improvement but instead fell for internal politics and infighting from people who are realistically unemployable in any other place. And no one seems to care. (13/?)
I am not sure there is a lesson here. CISO's need to understand organisation politics but most do. This was more a role which was a trap. They've even decided to no longer have a CISO, instead IT Security report to IT who report to CIO. Clearly, this is a bad idea (14/?)
But no one cares. Now it is harder for people in IT Security to show up the people who are making bad decisions. The organisation's board and senior leadership seem happy that no one is reporting problems. If this doesn't worry you, you probably dont work in security... (15/END)
