I believe CISOs need enough technical knowledge to provide direction and guidance to their teams. Again, balance is important. If a CISO is too technical, you run the risk of not communicating well with business leadership. Too little technical understanding, and you underserve the security organization.
Transformation Journey
I believe it’s really valuable to undertake periodic transformations of security approach and technology stack to ensure advancements don’t stagnate. Over my career, I’ve undertaken multiple endpoint security transformations – achieving consolidation of providers, uplift in capabilities, and cost reductions. The move to Zscaler offered us the opportunity to consolidate four different solution providers into a single relationship, enhance our security capabilities, reduce overall cost, and provide more flexibility for our business through cloud vs. on-premise solutions. At NCR, we’ve also undertaken a transformation in our detection and response technology – shifting from on-premise to cloud-based. When complete, this move will ensure the security team focuses on security and not managing infrastructure.
Lessons Learned
Over the course of my career, I’ve learned that the people side of change management is the hardest – relatively speaking, technology change is easy. Regardless of size, an organization can only absorb so much change so fast. To ensure success, it’s essential that security teams put a real focus on communications and collaboration. You have to make sure that change is something that is “Done With” vs. “Done To”.
