CISO: Your First 90 Days

[@HannahWalters]

Hi Bill, I just started in a new CISO role 2 months ago and this helped me a lot. I've definitely been falling into the trap of just doing what's familiar and struggling to balance strategy and force myself to stretch out into the unfamiliar aspects of the role. I come from a technical background which means I have so much to learn on the strategy and relationships front, but this helped immensely and I think it will put me on the right path. Thank you so much.

[@billcampbell9988]

Delighted you found value!

[@mosymuis]

I keep coming back to this. Wonderful analysis and advice in here!

[@technotambo2]

I have been preparing for a CISO role because I have both Cyber Security and Management training, you have really helped me!!

[@billcampbell9988]

Best of success to you, then, @FOG Travel!

[@Tmr6030]

Having been worked for 25yrs, 15yrs as CISO these are valuable insights👍

[@ชเเดชกบเช]

Proud to be the 100th sub. This man speaks truth.

[@tombyrne2225]

Thanks Bill! This video was very informative and entertaining.

[@AdityaAdv]

Good presentation, helped me form my thoughts on the topic, thanks!

[@jennypouwels208]

Thanks for giving us information and insight in an entertaining way! very good video

[@adityadwivedi8798]

can you make a video on How to became ciso for newbies starting their career in cybersecurity

[@jack6539]

Well done. I sense someone who knows scm well. Am I right?

[@billcampbell9988]

I have to concede that I don't. But as someone who is not familiar, I'm now curious what intersection you saw with what I'm discussing here. Maybe I should learn more about SCM?

[@jack6539]

@@billcampbell9988 I can't remember the context when I posted this, but yeah, software configuration management was the predecessor to Devops. Good SCM teams handled what is today called devops and much more - governance, security, full traceability from needs to standards, to requirements, designs, code, binaries environments, customers. Most SCM teams just focussed on build and deployment automations, so when Devops came along, they all rebranded, leaving behind the other aspects of which we are all feeling the pain for now imo. The last decades focus on time to delivery and more features at the expense of everything else has, imo been a disaster from a security perspective. BTW: I just buzzed out at the chicken versus pig analogy - if you don't mind, I really want to incorporate that one into my rants.

[@billcampbell9988]

@@jack6539 omg how embarrassing. I thought when you mentioned SCM you were referring to Supply Chain Management. Yes, of course I'm very conversant with what we used to call SCM (Software Configuration Management) years ago, but which has since been rather overtaken by a spectrum of disciplines and technologies (e.g. devops, as you observed). And you're welcome to use the breakfast analogy as you see fit! :-)

[@cornywallyja]

at 4:50 Lol Lol Lol Lol!

[@735Secure]

Big thumbs up, thank you!

[@patelgaurav4808]

Hii, what i should study in college to become CISO?

[@billcampbell9988]

I'm sorry; I'm not very familiar with college degree programs. As I point out in the presentation, there are many paths to CISO, all of which are valid. There isn't One True Way(TM) to get there. A degree in Computer Science or Cybersecurity might be a good start for some, but it's hardly the only way. And by the way, I don't think you'll ever find yourself in a situation where the CEO says, "Gaurav would be the best choice for the new CISO, except he didn't get the right degree all those years ago so he's out."

[@patelgaurav4808]

@@billcampbell9988 Thanks for sharing this information. It's help me a lot.

[@eng.samialhejailan7917]

hi Bill need consultation in my career path ? how i can reach you ? thank you

[@billcampbell9988]

Sorry didn't see this until now. You can reach me at [e-mail]

[@HulkWorldWar1]

Great information Bill. We were just bought by a company that doesn't have a mature security program or infrastructure team. It will definitely be a challenge to change their mindset of prioritizing cost before risk.

[@billcampbell9988]

Thanks for watching, Alex. Maybe it's what you actually meant, but of course, cost containment will always be a priority for responsible business leaders. What's sometimes missed is that assuming a risk (deciding not to invest in controls) has a cost. And that cost is incurred by the business intrinsically even if it's not explicitly recognized and acknowledged by management. Best of luck to you with your organizational changes!

[@bluestar9486]

Thank you!

[@eledu21]

jajaja en el min 12:29 aparece Raul Alfonsin!! que tipo inservible!

[@billcampbell9988]

Es una foto de archivo; ¡No esperaba que los argentinos se dieran cuenta! Jejejeje

[@rahulmaji2310]

nice info thank you bill

[@easyappscompany]

regards