It is often said that for information security, the absence of failure does not mean success. Put it another way the security team has to be constantly vigilant and always watching for the current and next threat that may come our way. Just because there is no noise on our security sensors does not mean we are not under attack. Enter the ever-vigilant and paranoid CISO.
Paranoia is a good thing when used constructively to build a proactive security posture. Every CISO needs to have a paranoid element to their persona. A good and healthy dose of paranoia, when not taken to the extreme, leads to a never-complacent attitude and an environment of continuous improvement.
The paranoid CISO because of the non-complacent paranoia will be more successful than most. This paranoid CISO is not going to live an incident-free life, but will encounter breach incidents like most of us. However this CISO is more likely the one whose team will discover the intrusion earlier than the rest or will proactively recognize and head off a security incident before it occurs or will build a more resilient security program than most.
So what makes you a paranoid CISO?
Here are 10 key elements for healthy paranoia in an information security leadership role:
Many of the older Cold War era movies and comic books featured spies constantly looking over their shoulders and watching their back. Yes, the paranoid CISO is all of that and more. Not only does the paranoid CISO need to look out for the enemy within and behind, but the CISO has to constantly probe the horizon for what's coming, while at the same time, staying in lock-step with the business . . . all of this while trying to get a good night's sleep.
George Viegas is a C level security executive in the banking industry.