Page 38 - Cyber Defense eMagazine August 2024

P. 38

Becoming a master in any field typically requires years of dedication, practice, and experience. The ten-
day timeframe in the parable can be seen as a metaphor for the concentrated effort and accelerated
learning that can happen when one is fully immersed in a task. But it somehow also symbolizes how
significant growth and transformation can occur in a short period when one is highly focused and guided
by an experienced mentor. True mastery is a lifelong pursuit that extends beyond a brief, intense period
of learning.

So is it with the vCISO. A vCISO can transform their skillset through periods of intense learning, enabling
them to stay ahead of emerging threats, adopt the latest security technologies, and continuously refine
their strategic approach to cybersecurity. But it is up to the vCISO to spend the time and effort in becoming
the greatest possible resource for an organization.

Countless books and articles detail the path to becoming a successful CISO or virtual CISO, but this
writing does not aim to cover all those necessary qualities. Instead, it focuses on the most valuable
activities that can be undertaken within a critical two-week (10 working day) period to significantly
enhance an organization's security. While an experienced vCISO must develop skills over a lifetime of
work, the “10 days” parable may be an indicator of how intensive his or her learning curve - which
perspective will show through with the right vCISO.

Budget of Time

The virtual Chief Information Security Officer is working on a budget of time. The vCISO is unlike a full-
time CISO in that there is a time-boxed border around the work the vCISO does as a contractor and
therefore, time is of the utmost importance. Every day of engagement must “move the needle” and the
first 10 days can provide a good measuring stick of how the engagement will go over the long term.

10 Days Before Engagement Starts

To effectively vet a vCISO before starting an engagement, an organization should undertake a
comprehensive evaluation process. First, the organization should clearly define its specific needs,
objectives, and expectations, identifying key areas such as risk management, compliance, incident
response, or security strategy development.

Verifying the vCISO’s credentials and experience is crucial, including checking for certifications like
CISSP, CISM, GIAC, CRISC, CEH or CISA (amongst others) and reviewing their professional
background in similar industries or organizational sizes. Evaluating their expertise and skills through
technical interviews or assessments helps gauge their problem-solving abilities and technical proficiency.
Requesting case studies and references from past clients or employers provides insights into their
performance, reliability, and professionalism.

Furthermore, assessing the vCISO’s communication skills and cultural fit is essential to ensure they can
articulate complex security concepts to non-technical stakeholders and collaborate effectively with
executive leadership teams as well as technical teams.

33 34 35 36 37 38 39 40 41 42 43