Retired CISO @RetiredCISO

Those relationships eventually expanded to Brazil, Australia and New Zealand... When the opportunity came to build a global team, much of the foundation was already there.

Before I had a global cybersecurity team, I tried to build a corporate team that people actually wanted to work with. I also spent a lot of time with our IT leaders in the UK. They already had a strong security program. I learned from them.

He ran down the street after it...didn't want to go back and explain that the first one had blown away. The paperwork stopped. He caught up and stomped on it, relieved. Footprint on the corner. That was my first exposure to Sarbanes-Oxley and the *only* one I still laugh about.

Short meeting. He got the signature. On the way back, walking between buildings, the wind blew the paperwork out of his hands.

First week at the company. I was shadowing a guy in distributed systems. He needed a Sarbanes-Oxley sign-off from a senior IT executive. We were walking over to get it. I could observe.

Even 12 of 12 would not have meant they were safe. Compliance is not security. That was the line I used when we asked the business to fund the gaps. PCI got the money conversation started. It did not get to stand in for a guarantee. PCI became a pattern for how we protected sensitive data. It was never proof we wouldn’t get hit.

TJX disclosed in 2007. The intrusion had been running since 2005. Tens of millions of cards. A forensics report in the aftermath said they met 3 of the 12 PCI controls.

That’s how I started a risk-acceptance process, and how I got a real relationship with the business. Credit cards were their decision. The gaps were now a named risk. That’s how the platform got funded, and how the team started to grow.

The business had decided to take credit cards. What came with that was not optional.

Treasury asked for help with PCI DSS. This was 2005, 2006. I had the corporate data center... shared services for every line of business. We didn’t have a PCI committee. I was already trying to get an enterprise vulnerability management platform funded.

You can't guarantee a company won’t get hacked. You can say which risks you are funding and which risks someone is signing. A CISO who offers the guarantee doesn’t know what they’re doing.

I used the risk-acceptance process instead. Those seats weren’t luxuries. They were how we implemented the control or supported it. If the seat wasn’t there, someone had to sign that we were accepting the risk.

It occurred to me that at annual budget time, most functional leaders were asking for more headcount. The standard answer was no.

The first year I put additional people in the annual budget, the answer was no. Over the next few months, I got those employees. I didn’t wait for the next annual review.

The CFO’s response came back. I later learned it was the usual response: "Global IT Security's annual budget must remain at or under last year's budget. Request for additional personnel denied."

That year I asked for two more people. I thought I was negotiating. They might not give me both. They’ll certainly give me one. Wishful thinking.

I started with a very lean cybersecurity team. The company was doing about $6B in revenue. Three of us in corporate cybersecurity. It took about a year before my boss finally gave me the department budget to manage.

one of the reasons i like being a retired ciso is that i don't have to listen to security vendors talk about their "single pane of glass" solutions any more

"No, and if I said yes then you should fire me." Silence lingered. Then an approving nod. Others around the table seemed to agree. That was my first Board meeting. They got tougher after that.

"Can you guarantee that we won't get hacked?" My mind raced. Everything the team did. The clichés. Weakest link. An attacker can get it wrong over and over. You’re wrong once, you’re toast. I answered from my gut.

All that preparation and rehearsal, and the deck never left slide 1. It was conversational. Our VP of Internal Audit had warned me about one guy. Very technical. On our Board. Full-time C-suite at a global media company.