Retired CISO

Ex-CISO. 20+ years in security. Lessons, decisions, stories.

[Retired CISO @RetiredCISO]

That’s how I started a risk-acceptance process, and how I got a real relationship with the business.

Credit cards were their decision. The gaps were now a named risk. That’s how the platform got funded, and how the team started to grow.

[Retired CISO @RetiredCISO]

Treasury asked for help with PCI DSS. This was 2005, 2006.

I had the corporate data center... shared services for every line of business. We didn’t have a PCI committee. I was already trying to get an enterprise vulnerability management platform funded.

[Retired CISO @RetiredCISO]

The business had decided to take credit cards. What came with that was not optional.

[Retired CISO @RetiredCISO]

You can't guarantee a company won’t get hacked.

You can say which risks you are funding and which risks someone is signing.

A CISO who offers the guarantee doesn’t know what they’re doing.

[Retired CISO @RetiredCISO]

I used the risk-acceptance process instead. Those seats weren’t luxuries. They were how we implemented the control or supported it.

If the seat wasn’t there, someone had to sign that we were accepting the risk.

[Retired CISO @RetiredCISO]

The first year I put additional people in the annual budget, the answer was no.

Over the next few months, I got those employees. I didn’t wait for the next annual review.

[Retired CISO @RetiredCISO]

It occurred to me that at annual budget time, most functional leaders were asking for more headcount. The standard answer was no.

[Retired CISO @RetiredCISO]

The CFO’s response came back. I later learned it was the usual response:

"Global IT Security's annual budget must remain at or under last year's budget. Request for additional personnel denied."

[Retired CISO @RetiredCISO]

I started with a very lean cybersecurity team.

The company was doing about $6B in revenue. Three of us in corporate cybersecurity.

It took about a year before my boss finally gave me the department budget to manage.

[Retired CISO @RetiredCISO]

That year I asked for two more people. I thought I was negotiating.

They might not give me both. They’ll certainly give me one.

Wishful thinking.

[Retired CISO @RetiredCISO]

one of the reasons i like being a retired ciso is that i don't have to listen to security vendors talk about their "single pane of glass" solutions any more

[Retired CISO @RetiredCISO]

"No, and if I said yes then you should fire me."

Silence lingered. Then an approving nod. Others around the table seemed to agree.

That was my first Board meeting. They got tougher after that.

[Retired CISO @RetiredCISO]

All that preparation and rehearsal, and the deck never left slide 1. It was conversational.

Our VP of Internal Audit had warned me about one guy. Very technical. On our Board. Full-time C-suite at a global media company.

[Retired CISO @RetiredCISO]

"Can you guarantee that we won't get hacked?"

My mind raced. Everything the team did. The clichés. Weakest link. An attacker can get it wrong over and over. You’re wrong once, you’re toast.

I answered from my gut.

[Retired CISO @RetiredCISO]

A voice towards the front and the left interrupted me. Not rudely, but firmly.
"Michael, if you don't mind... we all did the pre-read so we're familiar with what's in your deck. Instead we have a few questions for you."

[Retired CISO @RetiredCISO]

I walked into the room. The CEO. CEOs of other companies who served on the Board.
I had pictured myself standing at the front. There was a chair for me towards the back.
"Have a seat," somebody said.

[Retired CISO @RetiredCISO]

The deck sat on slide 1: my name and title. Four slides behind it. Two months of work.
I had rehearsed those 15 minutes a hundred times. I sized up the room. They looked ready. I started to introduce myself.

[Retired CISO @RetiredCISO]

The door opened. A woman smiled and whispered:

"They're ready for you."

[Retired CISO @RetiredCISO]

After two months of prep, it was the day.

I took the elevator to the executive floor, the top floor of the Corp HQ building. I was ushered to a chair outside the conference room and told they would invite me in when I was up.

[Retired CISO @RetiredCISO]

I sat in that chair for what seemed like an eternity. Heart beating out of my chest. Wiping my sweaty palms on my slacks.