How do you evaluate the impact of your security skills on your projects?

Interdisciplinary Skills are a Plus Cybersecurity is not just a technical domain; it intersects with legal, regulatory, and human-behavioral aspects. Expanding your skills in these areas will make you more effective in comprehensively securing a project. Peer Review is Underutilized Peer reviews can offer invaluable external perspectives on the effectiveness of your security measures, serving as an additional metric for evaluation. Don't Ignore Soft Skills Communication can make or break a project's success, particularly with non-technical stakeholders. Your ability to explain the importance of security measures can significantly impact securing the necessary resources and compliance.

Although security in its own is important, applying it must align and serve business needs. When conflicts arise between better security and achieving business goals, business is the one that decides which risk to accept and which to mitigate. Security professionals must always take into consideration that they protect business not control it.

Align security goals using a digital services framework like ITIL or Cobit. We have well-established frameworks to to guide security goals definitions. The key is to tailor and combine to deliver minimum viable products and services, followed by continual improvement projects (e.g., people, processes, and technology).

Defining clear and measurable security goals which align with the enterprise cybersecurity strategy is absolutely critical else the overall security objective cannot be achieved.

Although, we need Subject matter experts to achieve the excellence. In my opinion when we think about a team and associated task role of a leadership is very important. There is saying Jack of all master of none. This is very well suited saying to any leader. Similarly having the awareness of security skills is always added advantage. Considering the current era of software. It’s very much important to have security skills with you. When we deliver the solution, clients expectations are not only to fulfill the needs they need the solution must be secured in all perspective. We have seen the solution failures if it’s in non compliance of security. It increases the success rate. Thank You

collecting and analyzing security data is essential for measuring the impact of security skills on projects. By collecting quantitative data such as security metrics, indicators, and scores, as well as qualitative data such as security feedback, reviews, and audits, you can gain insights into how well your projects meet the security goals and how your security skills contribute to the security outcomes.

Cybersecurity is a multidisciplinary sport. It is important to measure security not only to verify your impact as a person, but mainly to verify if the projects/policies/mechanisms have the desired impact in terms of risk reduction/mitigation, and how much they are affecting the business. Many talk about collecting security data, but this is too generic. If you're a security mechanisms builder, create KPIs for it: measure coverage (how many % are using the mechanisms?) and quality (how much % of the threat does the mechanisms cover?). Collect user feedback (CSAT, NPS,...). This is a good place to start and one that can be easily improved upon. Other areas of security need other metrics, especially if you are part of a service team.

In the intricate realm of cybersecurity, empirical evidence is key to comprehending the strengths and weaknesses of your security posture. Delve into both quantitative facets, like security metrics, Key Performance Indicators (KPIs), and Common Vulnerability Scoring System (CVSS) ratings, and qualitative dimensions, encompassing feedback from security assessments and post-incident reviews. This methodical data collation and examination can offer invaluable insights into the alignment of your projects with security benchmarks, and the tangible value your security expertise brings to the table.

Nowadays various tools are available to ensure this . Use built in tools and AI to implement the same. Any mechanism or data does require an audit. It's suggested here that both internal and external audit be done to ensure compliance of security tools at different times and levels.

Data is king when communicating effectiveness to upper management. It's hard to show the impact of something not happening though. You need to be able to count real attacks and where they were caught and stopped in your organization. This will help you identify systems and teams you can't live without and even help prioritize spending, outside of communicating your effectiveness in the company.

Show impact is important, so you need to communicate and showcase your security impact. It is necessary to separate what is accidental impact from what is real impact. The accidental impact is when people are obliged to use, so the impact it caused wasn't because the project was good, it was because of the obligation. The real impact appears due to consistency, accountability, and velocity where projects cause technical leverage (or organizational leverage - for managers). Your expertise, innovation and leadership are drivers for the project success and are easily measurable. Career progression happens more often with projects made specifically to solve organization threats than implementing generic tools that do not address real risks.

Presentation format is in your control. But remember limited information to limited stakeholders. Further dissemination and electronically is now the click of the mouse or thumb. Need to know the basis is keyword.

To achieve the best results in demonstrating the impact of your security skills on projects, it's essential to engage in effective communication and presentation of security data, results, and accomplishments to stakeholders, including managers, clients, peers, and users, using various formats and channels such as security portfolios, case studies, blogs, podcasts, and conferences, to enhance your credibility, reputation, visibility, and recognition as a security professional.

Information security is constantly evolving subject, therefore cyber security professionals need to remain updated wrt new strategies, threats, concepts and tools.

Something I find valuable is actively looking for new projects and cases through events or even reliable feeds. Virtually all well-know events have recordings on YouTube, allowing wide access to this information. Additionally, there are extremely well written books that help with fundamental concepts that can be used as building blocks for new security projects/mechanisms. Personally, I avoid courses that are less than 40 hours long and don't have a reliable track record of success. There is a whole market of courses and certifications that only serve those who are entering the area. Initiatives such as NIST/NICE and UK/NCSC/CCP are the most promising for cost-effectively building and improving your skills.

The ever-evolving landscape of cybersecurity demands unwavering commitment to continuous learning. While courses, certifications, and mentors are invaluable, adopting a proactive cybersecurity mindset remains paramount. This involves not merely reacting to breaches, but proactively anticipating cyber threats. Activities like threat modelling, penetration testing, and staying updated with cybersecurity news and updates are crucial. Engaging in capture-the-flag challenges also sharpens one's defensive and offensive skills. Promoting a robust cybersecurity culture within your team aids in collective defence. Remember, cybersecurity is a persistent journey, and only through dedicated efforts can we safeguard our digital assets.

This aspect is important for any project. Sharpening of pencil is comparable to sharpening of skills. Ongoing process never ending process results oriented process. Punchword SWOT

As the saying goes "Leaders are readers", and if it's security skills, it is of paramount importance. If we analyse closely, in every aspect of our life, we are somehow applying our security skills. Whether it's securing our netbanking, mobile, others accounts with MFA or locking our doors while stepping away from home/office. So it is embibed in our personal/professional life. And whatever comes natural to us, becomes easy and effortless. We have seen numerous examples that without a security skill, a project can't be completed conclusively. We either end up overshooting the project budget since security wasn't thought of in the initial project plan and after spending a lot of energy and efforts, we are being forced later

Stay an out-of-the-box thinker! 1. Always have a person or group, act as a red team whose job is to challenge the approach and find gaps and mistakes 2. Don't overdesign everything; sometimes simple is the answer 3. Don't reinvent the wheel, especially when dealing with cryptography and its related aspects

A key bit in this space is actively seeking out and working with the security function in your organisation. This will typically be on the governance side of things, being the audit and risk function, or the cyber/information security function (the SOC, penetration testing team, security engineering/architecture). The bane of any internal security team is being seen as adversarial to the business or individual project teams. When you find the right contact points in security, it is likely that they will be excited to help you navigate the internal security requirements of your organisation, or the broader, fundamental aspects that should be covered to protect against external threat actors.

Thinking about career, working collaboratively will bring better results in the long term. For example, helping to break silos, influencing other teams, establishing cross-functional relationships, getting the right conversations and having the ability to disagree but be committed due to priorities will bring very important constructive feedback. Also, having a professional people manager (with a security background) will really make a huge difference. It is very common in InfoSec to have managers who are not people managers and simply ignore the careers of their subordinates. Choose a manager who will prioritize people and, as an engineer, take responsibility/accountability for projects.

Yeah feedback no one can deny . It's very vital to audit and refine. It is like steering the project on the right track for the right results . All stakeholders are to be involved for feedback. Even non potential members can give u key inputs. Therefore keep listening and keep steering the right course.

Just as libraries and museums have curators, your company should have security curation as a priority. To maximize the impact of your security skills on projects, actively seek and incorporate security feedback from stakeholders like managers, clients, peers, and users, while also offering constructive security feedback to others, employing techniques and tools like security questionnaires, ratings, reviews, and improvement plans to recognize strengths, learn from mistakes, and continually grow in security proficiency.

In my Cybersecurity experience any company including financial sector need to extend and enchance their security solutions and posture check to be properly in to their environment. I disagree when the companies do their security solutions up only when ISO or audit activity starts. In my recommendations continues improvements is essential for any organisation.

In my cybersecurity journey, I've learned the importance of recognizing and celebrating our achievements. Beyond addressing threats, it's vital to reflect on and appreciate our contributions. Whether it's through self-assessments, peer testimonials, or even small security celebrations, acknowledging these milestones fuels my passion. It's not just about personal satisfaction; it's about inspiring others and setting the stage for greater advancements in this ever-evolving field.

In your pursuit of enhancing the safety of your park, it is crucial to adopt risk measurement as a guiding principle. By systematically assessing and quantifying potential risks, you can develop informed strategies to mitigate them effectively. This approach allows for a proactive and data-driven approach to safety improvements, ensuring that resources are allocated efficiently and hazards are minimized.

From a personal development perspective you can show new skills in action by calling out different approaches or speed to implementation with each project or task you complete. This will help you continue to find funding at your company for new training opportunities.

Prepare KPIs based on your security objectives and continuously measure your performance. A few of them may include: -Reduced number of security incidents, -Faster incident response time, -Reduced number of unremediated vulnerabilities/unpatched systems, -Increased number of phishing incident reports by employees, -Better performance in terms of phishing test result, -Better obedience to security policy, -etc, etc.