CISOs know that hiring good talent is getting more difficult than ever.  Finding people who are both qualified and willing to work for you under your corporate rules is starting to become one of those tasks you outsource because you can't do it yourself.  Some will tell you that the reason for this is the climate of increasingly high risk, but I think there are actually two things going on here we need to take a hard look at.

The lack of technical talent

今日は地球の裏側にある世界で最も早く日の出が見られる美しい国、ニュージーランドからお届けしよう。ありがたいことに、ニュージーランドで開催されている一連のCISOランチョンにホストとして招かれており、CISOが各地域で直面している課題や成功事例を紹介させていただいた。筆者はここ3日間で行われた2つのオープンフォーラムのディスカッションで興味深いことを学んだ。CISOの仕事をCISO以外の者が行なっているケースがあちこちで見られるという。

ある情報セキュリティのコミュニティでは、これについて水曜日の夜にツイッター上で論争が巻き起こっていて、明らかに否定的に受け止められている。筆者がディスカッションでこの件を取り上げたところ、セキュリティの専門家が、セキュリティの経験が不足している者がセキュリティに責任を持つことに対して目くじらを立てていたが、全くその通りだ。その一方で、筆者が意見交換したマネジメント経験を持つ者や、IT幹部レベルのゼネラリストたちはこれを歓迎していた。なぜなら、これでようやくセキュリティとビジネスがかみ合うようになると考えているからだ。

Too often I hear the phrase "How much security can we afford?" and I can't help but believe that this question fundmentally mis-understands what business-centric security really is.  I've had at least a half-dozen conversations in the past few months with various security leadership froma cross different organizations and verticals where the understanding is clear - you can't even spend enough to get the kind of security you think you need if you don't understand your business.

A number of years ago I was working for an organization that had subsidiaries in the medical field, nuclear power generation and just about everything else that touched our everyday lives.  Many of my co-workers we charged with defending those networks against attackers both internal and external, and back in those days before security was ever really understood they did it on a shoestring budget.

Greetings from the land down under, the beautiful country which gets to first greet the sun of the new day - New Zealand.  I've had the pleasure of traveling down to host a series of CISO luncheons to talk about the challenges and triumphs that CISOs face here and elsewhere in the region.  I've learned something interesting from the two open forum discussions we've had over the last three days and that is that there are a number of you out there which are not CISOs doing the CISO's job.

Over on my corporate blog (Following the White Rabbit) I'm running a 4-part series focused on BYOD, or bring your own device.  If you have some time to read it, I advise you do so for a more technically in-depth assessment of the topic.