2. Identify and Align Security-Related Roles

A business can’t run a security program by dint of the security team’s efforts alone. Business leaders need to communicate the importance of supporting security to the whole organization. Table 2-1 provides a brief layout of basic security functions across the organization. The rest of this chapter goes into much more detail, breaking out these functions and how they work together.

The security program rests on the shoulders of many people with security-related roles. These roles must be aligned. For the purpose of Rational Cybersecurity, we define alignment as follows.

Although security leaders head up the security function, they also report to a business leader such as the CIO or CEO. In general, top business leaders are responsible for “owning” information risks as part of enterprise risk management, overseeing the operations of security leadership, and setting cybersecurity budgets and strategic priorities for their areas.

To effectively carry out their security oversight functions, business leaders must understand the business impacts of information risk and the value of cybersecurity as a business enabler that helps organizations grow, or operate, with confidence. Business leaders set the “tone at the top” which determines whether business staff will treat security policies as mandatory requirements or as optional ones to be followed when convenient. Senior business executives must also adjudicate any disputes between the security function and business managers or staff.

Unfortunately, business leaders don’t always understand what’s needed for them to control and oversee the security function. After all, this wasn’t on the Business School curriculum at university in the 1970s, 1980s, or 1990s when most of them got their degrees; digital businesses and organized cybercrime simply did not exist at the time.

Common challenges with people and organization in cybersecurity on the business side include

If the core security organization is not well led and staffed by motivated people, it’s difficult to see how to address this chapter’s list of formidable security challenges. One hopes that organizations have a strong and motivated CISO in place. The CISO must then hire, motivate, and retain the right security staff.

According to the ISSA/ESG survey, the top factors for motivating and retaining security resources are

The following example indicates reducing stress levels and increasing the effectiveness of the security program itself are important to morale and retention.

It remains to be seen whether the health-care CISO’s impressive attrition improvement can be sustained over time or if other organizations can duplicate it. It seems likely that many if not most organizations will continue to have turnover. In addition to reducing the level of turnover – businesses need an active hiring program. Some recommendations for effective hiring and retention are

Another major success factor to building a sense of effectiveness for the security team and throughout the business is to align security functions (inside and outside the security organization) with the various security-related business roles.

To increase business engagement with security programs, leaders on both sides of the aisle who “get the picture” should work together to spread the meme that “business leaders own the risk, security leaders provide the tools to manage it.”

As I see it, CISOs often have two related engagement challenges to overcome:

Making cybersecurity strategic: Suppose you’re a CISO, or on the CISO’s management team, in a business whose executives don’t consider cybersecurity strategic. You believe that the too low priority on security significantly blocks you from doing the work that needs to be done. Then, as a diligent professional who wants to be effective, you have two choices:

I would suggest CISOs take both these choices; do the work that you can do in the organizational climate while protecting your career, but also make efforts to change the climate for the better. To gain mindshare, CISOs can try to get more of the security and risk message in front of Executives and the Board. Seek auditors, third-party assessors, and external Board–level speakers who are known for advocating a more active Board role in cybersecurity and a strong executive tone at the top.

CISOs can also pursue either a low-key or overt organization change strategy. At the low-key level, keep doing what CISOs should do anyway:

For additional communication tips and advice on security culture change strategies, see Chapter 4.

Part of the security leaders’ job is to work with the business to clarify their own, and business leaders’, security-related roles. Security leaders should work to increase buy-in from executives and also endeavor to push the cybersecurity message down and across the ranks.

Security-related roles should be formalized in security policy and reinforced through awareness, training, and communications programs. Although in an ideal world business and IT leaders or staff would comply with all security policies, they often don’t. However, security leaders can follow up with business leaders to ensure they understand and buy into policy. Clarifying security-related roles in itself gets business and security leaders much more engaged. See Chapter 4’s section “Or Your Best Opportunity?” for a vision of what it looks like when the players understand and fulfill their security-related roles in a healthy security culture.

Use Responsible, Accountable, Consulted, Informed (RACI) matrices; they are useful tools for creating better role definitions. Even if policies don’t actually contain a RACI, they can be more effective if they contain the kind of specific role information a RACI provides. Moreover, business and security leaders can take already-existing RACIs from the COBIT 5¹² standard and scale or adapt them to the needs of the business.

As an example, Table 2-2 provides a RACI for the four highest-level risk and security management practices discussed in Chapter 1, where you’ll recall establishing business ownership for risk is a major emphasis. This RACI clarifies the roles that security, IT, corporate administration, and other business leaders should have for managing business value, risk, the security program, and security operations.

This RACI is loosely based on the role assignments from COBIT 5’s Evaluate, Direct, and Monitor (EDM) and Align, Plan, and Optimize (APO) practices to Ensure Benefits Delivery, Direct Risk Management, Manage Risk, and Manage Security. I have simplified the COBIT roles somewhat to scale the discussion for mid-sized as well as larger businesses. Even so, many businesses won’t have all these roles. That’s OK. Focus on the ones you have.

Now that we’ve covered some of the CISO’s top priorities for engaging the business leadership, we’ll turn to the challenge of engaging staff or users. We’ll also come back to the topic of working with business and IT leaders on security alignment to IT, security culture, and security governance at more depth in later chapters.

(Nonsecurity) business staff members and managers (aka users) also have security roles to play. Users should follow the business security policies, such as those for password and credential management, or acceptable use of business resources. They should exercise caution in their daily interactions with email, web browsing, and the Internet to avoid contracting malware on their PCs or smartphones.

As emphasized earlier, it is important for security leaders to gain top executives’ support and to formalize security-related roles and responsibilities in security policy. The goal is to get IT or business managers and staff to always follow the desired security policies or practices.

But some policies are more clear-cut than others, and sometimes it’s difficult for the user to judge whether the policy applies. For example, sales staff must understand whether a particular product plan is confidential or not and what is the information classification policy, or else they are likely to share product plans with prospects to make the sale they are incentivized to make for the benefit of the business.

When an IT or businessperson doesn’t understand what the policy requires in a complex, real-world situation, will they ask the appropriate security, compliance, or corporate administration team for guidance? Very often, the answer is no. But if they believe the security team has their back, that it is looking for ways the businesspeople can get the job done with less risk, then they’re more likely to ask. Security teams can increase the likelihood businesspeople will come for guidance by earning their trust and cooperation.

As a security leader, you must understand the users’ perspective. Going about their day-to-day business, users have a job to do and that is their priority. Studies (such as a behavioral economics experiment¹³ simulating bank account login, strong authentication, and risk of losing money to cyberattacks) have found that more than 50% of participants make rational (e.g., utility optimal) decisions on how much of their personal time to spend reducing an expected amount of security risk.

Security professionals at all levels must “communicate effectively” and with a “sense of efficacy.” Treat users as the rational and supportive team members you need them to be. That could mean explaining why they should always follow the policy without question, or how to calculate the risk and decide, or the importance of escalating the question. Explain the risk as best as possible in terms of the users’ business function and the reason why it is important to follow the policy or accept other security requests and tasks. Send positive messages that by following the security team’s recommendations, users can make a real difference to their personal security as well as the business’s cybersecurity posture. Chapter 4 provides more guidance on user awareness programs.

The core recommendations for security leaders from this chapter are to

Section “Clarify Security-Related Business Roles” and Table 2-2 contain a list of typical stakeholder roles. In a small business, some of the roles may not exist and others will be combined in a few people. In a large business, multiple people may fill some of the same roles across business units.

The Rational Cybersecurity Success Plan Worksheet¹⁵ provides a structure for security leaders to identify stakeholders to align with. Depending on the size and complexity of the business, and a security leader’s priority focus areas, it may be necessary to prioritize relationships with many stakeholders or with just a few covering the priority focus areas.

Fill in the name of the person holding each role identified in Table 2 of Section 2 in the worksheet. If a role doesn’t exist or is called something else at your organization, then remove, edit, or annotate the row. In the Contact Plan column, note whether the person should be contacted now or later and who will be the relationship manager (i.e., you or someone else from the security team). Fill in the Topics to Cover column with any known issues, projects, or pain points to cover with the stakeholder.