“You need to be able to reverse engineer your cyber security program or strategy with the end in mind. You need to understand what the mission, the vision, the strategy and the goals are for your organization because you don’t want to just plug in security and inhibit your company’s growth,” says Chimbanda, a senior cyber security professional in the investment banking industry who recently released a series of Cyber Security Leadership and Management courses in Infosec Skills. His three pillars of cyber security leadership, based on the CIA triad, are:
Security, which must be aligned with organizational strategy to provide confidentiality Trust, which must be aligned with regulatory obligations to provide integrity Stability, which must be aligned with operational excellence to provide availability
A leader or manager needs to recognize these as the foundation for cyber security, says Chimbanda. “Anyone that’s in cyber security or wants to get in cyber security understands that is the deliverable: confidentiality, integrity and availability.”
Cyber security risk management training bridges the gap
A good cyber security leadership plan should align with your company’s goals and not inhibit your organization, says Chimbanda. That means you need to start with your end goal and work backward instead of focusing exclusively on security. “If your security inhibits your actual end goal, then it’s not security. It’s just an inhibitor,” says Chimbanda. “These courses will help you align cyber security strategy with the organizational strategy.” Cyber security leaders should be able to articulate how it benefits the business as a whole. “There’s a chasm when it comes to cyber security and actual business value,” says Chimbanda. “Cyber security leadership has to be able to articulate security to those in the front lines — to the stakeholders, to the customers, to the employees.” A good cyber security leader must be able to “in layman’s terms, bridge the gap so that individuals understand not only how they benefit from it, but also how they’re protected from it.” If someone doesn’t understand the significance of cyber security in their organization, they’re going to be less likely to follow through with good cyber security practices. On the flipside, someone who has a clear understanding of the role of cyber security is going to have an easier time.
Two roadmaps for cyber security careers
With cyber security careers, there are two main roadmaps you can take: depth or breadth. You can either go down the route of being a subject matter expert or aim for breadth and the ability to move laterally. For Chimbanda, breadth means “you’re basically the glue of all the other components that make up cyber security. You understand the business. You understand different roles, and you’re able to be a conduit for cyber security.” This is especially important if you want to be a chief information security officer. It’s also important to understand all the different cyber security roles. “You have your compliance experts. You have your managers for cyber security. You have your analysts. You have your intel. You have your forensics. You have your pentesters.” For cyber security leaders, Chimbanda says you need to ask yourself, “What do I need to do to help them get there? That includes understanding required soft skills, understanding people that are in mentorship roles, providing internships. There’s a whole roadmap I use for that.”
Hands-on learning and diverse experiences
Chimbanda makes sure to gamify his courses wherever possible, rather than rely only on lectures and theory-centric content. “This helps students to have fun, compete within the teams and go to different levels,” says Chimbanda. Having a diverse team in cyber security is also important because life experiences make a difference in how different people are going to approach a problem. “Somebody might not be a guru in math or might not be a coder, but they may have other experiences that will help them in cyber security,” says Chimbanda. Those diverse experiences can be particularly beneficial at the leadership level. Create your free Infosec Skills account to try his cyber security leadership training yourself.
