Security leaders must focus and adapt their messaging to effectively use risk management in navigating a chaotic cyber landscape, according to a panel of Chief Information Security Officers (CISOs). During a discussion on the final day of a prominent security event, these leaders from LexisNexis and RX Global emphasized the critical role CISOs play as business enablers and \u201ctranslators\u201d of risk to senior leadership.<\/p>\n
This significance is heightened in a landscape rife with AI-driven threats, insider risks, escalating business demands, and rapidly changing technology.<\/p>\n
\u201cYou have to ensure that your message is tailored for the audience you are addressing,\u201d stated Maritsa Santiago, CISO of Reed Technology at LexisNexis. \u201cWhen communicating with a risk owner, the approach differs from that taken with a business leader. Consider how they will best receive that information: should it be more qualitative or quantitative? We must enhance our ability to communicate appropriately with our specific audience to guarantee our messages resonate.\u201d<\/p>\n
Jeff Jenkins, CISO of LexisNexis Legal & Professional, reinforced this point with a Formula 1 analogy. He explained that suggesting to an F1 team that they \u201cdrive slower due to frequent crashes\u201d is a miscommunication. Instead, the focus should be on how to enable faster performance and greater success: \u201cUnderstanding your audience is crucial, as the solution will vary greatly from one situation to another.\u201d<\/p>\n
John Kelly, CISO at Elsevier, stressed the importance of understanding business terminology. \u201cFor too long, we have attempted to teach the business our cyber language, when we should have focused on learning their business language.\u201d<\/p>\n
Santiago also highlighted the necessity of strong communication skills and a solid grounding in the data-driven aspects of the CISO role. \u201cYou\u2019ve got to sell \u2013 the ability to influence is significant. However, possessing the skill set to generate supportive data for your requests is essential,\u201d she noted.<\/p>\n
Using appropriate language is vital for fostering a culture of security awareness within organizations. Santiago articulated that \u201cbuilding security awareness across the organization is crucial. Ignorance is not an option, especially as we face daily phishing attacks.\u201d<\/p>\n
Educating employees on the importance of security and its relevance to them personally is key to broadening their understanding. To achieve positive risk management outcomes, CISOs should strive to eliminate traditional silos between security and business functions. Des Massicott, CISO at RX Global, emphasized that \u201cwe should not view ourselves as separate entities. A disconnect will always exist if we do. The concept of \u2018shift left\u2019 encapsulates the importance of integrating security across all areas, from security champions to governance, risk, and compliance to operations.\u201d<\/p>\n
Paul Watts, CISO research and advisory lead at the Information Security Forum, concurred. \u201cPractitioners must invest time in learning about the business and actively listening to address risks effectively. Being inside the chaos limits one’s ability to manage risks effectively.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
Security leaders must focus and adapt their messaging to effectively use risk management in navigating a chaotic cyber landscape, according…<\/p>\n","protected":false},"author":1,"featured_media":1870,"comment_status":"open","ping_status":"closed","sticky":false,"template":"Default","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[28],"tags":[816,757,817],"class_list":["post-1869","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-communication-skills","tag-risk-management","tag-security-awareness"],"acf":[],"yoast_head":"\n