How do you get stakeholders and partners to support your security goals?

I always get principle buy-in from leadership, in particular CEO and CFO. Having their support will get others on board more easily. In my view investing in Cybersecurity is about loss prevention, not profit generation. Like insurance, it's about avoiding or minimising future losses from breaches. The costs of a cyber attack or breach can be enormous in terms of recovery, legal liability, reputational damage, etc. Cybersecurity helps mitigate potentially catastrophic risks.

The best way is to show them screen captures of all of the sites, passwords, credit card numbers, banking info and crypto wallets they store in their browsers that were scraped by an infostealer and are now for sale on the dark web.

Plan Stakeholder Engagement one of the most valuable ways to accomplish their needs : Plan Stakeholder Engagement involves conducting a thorough stakeholder analysis to identify all of the involved stakeholders and analyze their characteristics. The results of the analysis are then utilized to define the best collaboration and communication approaches for the initiative and to appropriately plan for stakeholder risks. When planning for stakeholder engagement, the degree of complexity can increase disproportionately as the number of stakeholders involved in the business analysis activities increases. This is important because new or different techniques for the management of stakeholders may be required when move into dozen of stakeholders.

Importance of asset, be it data, people or any physical asset, stakeholders look the importance of each at a perspective of their individual business getting impacted but at a security level we consider every asset with high importance, showcasing this importance and its impact on the over-all business will align the understanding of both the parties towards a single direction, neither of the parties can apply pull or push but can agree for a mutual allignment and result better fruits.

Proactive Risk identification, impact analysis without hindering the end user* experience is something that always helps the executive and board agree, accept,plan prioritise and fund their organisation’s security goals. In today’s world security is no more a compliance matter and this is well accepted among the C Class Executives.

Articulating the benefits and risks is a powerful way to gain stakeholder buy-in. In my experience, nothing resonates more than real-world examples. I often share stories of companies in our industry that faced severe consequences due to lax security measures, contrasting them with success stories where robust security led to increased customer trust and market share. Metrics are another persuasive tool. I've found that quantifying the impact of a potential data breach, in terms of monetary loss and reputational damage, can be a revelation for executives. On the other hand, demonstrating the ROI of security investments, whether through cost savings from automated processes or revenue growth from customer trust, can be equally compelling.

...in a non-technical way. The idea that if we do X we prevent Y is a simple concept for anyone to grasp so go behind that when explaining benefits and risks. The CISO's job is quantify, rationalize, and articulate risk. This should be done relative to the way the company operates, so explain benefits to the operation through mitigation and management of its risks. BTW in order to do this, you have to know your company's business inside and out.

Absolutely, this approach translates security concepts into the language of business that is understood, making it easier for stakeholders and partners to see the value of investing in security and the potential costs of neglecting it. It can certainly cost you dearly if you don't implement and invest in a security plan.

At the very end all leaders and process owners are interested in knowing”How this effects them, their team, or process”. As long as one is able to showcase to them the relevance and impact to their operations and project the potential risks in tangible business outcomes, you are going to be in a good position of support.

When talking about risks, instead of merely listing threats, illustrate them with tangible scenarios. Show, don't tell. For example, when discussing potential data breaches, don't just mention the risk of exposed customer data. Instead, walk stakeholders through a recent incident where a similar organization faced significant financial loss and brand damage due to a breach. Highlight how the breach occurred, the aftermath, and the long-term implications on their market position. This approach not only makes the risk more relatable but also underscores the strategic necessity of robust cybersecurity measures that can prevent such events and protect the company's growth trajectory.

This is the key. How can your stakeholders and partners support your security goals if they are not part of the process. Let's break it down into the two different groups. For stakeholders, you need to first understand their goals and risk appetite and build your goals to support theirs. For example, if your business has a goal to drive more revenue via eCommerce, you can create a SAST / DAST program with DevSecOps to support this goal. Working with Partners on your goals is different. Once you have defined your goals to support your stakeholder's goals, you should work with your partners by sharing what you can and getting them involved in being part of the solution. Again, this can only be effectively done through sharing.

OK let's Imagine your security goals as a grand orchestra performance, and your stakeholders and partners as the musicians. To truly strike a harmonious chord, you must invite them to take part in composing and conducting the symphony of security. By involving your stakeholders in this musical journey, they become more than spectators they become creators and performers. Think of them as your security goals.

Involving stakeholders in the security process is a strategy I've found to be incredibly effective. When people feel they have a stake in the outcome, their engagement levels soar. For example, I've organized workshops where business leaders, IT staff, and customers can provide input on our security policies. This gives me valuable perspectives and fosters a sense of collective ownership. Assigning roles is another tactic that works well. By designating security champions within different departments, you create internal advocates who can help disseminate a security-first culture throughout the organization. These champions become your eyes and ears, helping to identify potential vulnerabilities, and advocating for best practices.

Implementing a security solution, process and/or control almost always means a change! To implement a change effectively it is the best practice to involve all the stakeholders in the process.

One of the most challenging things in an organization is changing the culture, but this is one of the goals we want to achieve because to change the culture, we must place everyone in the same context and share responsibilities. By engaging top-down, the culture will spread throughout the company, and everyone will not only know that they are participating but also feel like they are a necessary part of the project; this way, we will gain engagement. As security consultants, we must always make people and business areas know that with them, everything is possible and that people are the strongest in this chain.

When we talk about training and support for Stakeholders, we talk about something continuous! It shouldn't be something like a one-shot because, as I said previously, we have to change the culture to facilitate acceptance. Consequently, we can implement a Cybersecurity program within the company. We can turn the tide and gain more acceptance by doing something continuous and periodic.

OK, let's take for example an explorer who can't embark on a successful treasure hunt without adequate guidance and survival gear, your stakeholders and partners can't effectively support your security goals without the right knowledge and resources. Providing them with training and support ensures they are well-prepared.

Providing training and support to stakeholders and partners is paramount for coherently applying security standards across the board. Tailoring educational initiatives, like workshops and webinars, to their specific roles and functions ensures the knowledge's practicality and applicability. Furthermore, offering resources such as guides and checklists assists in embedding security protocols into everyday operations, enhancing adherence to and effectiveness of the security framework. This educative approach uplifts the overall security posture and empowers each stakeholder to safeguard the organizational ecosystem against potential threats and vulnerabilities.

Training and support are indispensable for ensuring that stakeholders understand and implement security measures effectively. I've initiated various training programs tailored to distinct roles within the organization. For instance, our sales team focuses on data handling and client communication, while for our developers, it's secure coding practices. Support resources are equally crucial. We've developed a comprehensive internal portal that offers everything from quick-reference checklists to in-depth manuals. This serves as a one-stop-shop for security information, accessible to everyone in the organization.

As security/risk mitigation process result in change, there would be certain stakeholders for whom certain level of training would be required. Furthermore, security and risk mitigation needs to be owned as culture in an organization and everybody must be aware of ever growing threats and how they can contribute to mitigate them.

Any potential risk mitigated is cost saved! Just like any manager would be rewarded on saving cost for an organization, anybody who helped mitigate a risk to an organization needs to be awarded to promote a culture whereby every single individual contributes.

Recognition and reward are vital in reinforcing adherence to and enthusiasm for security standards among stakeholders. Appreciating their compliance efforts and achievements through acknowledgments like certificates or incentives boosts morale and amplifies a security-centric culture by highlighting its value to the organization. Furthermore, employing feedback mechanisms like surveys helps to ensure that the security framework continually evolves to meet stakeholder needs and adapts to new challenges, maintaining a dynamic, resilient, and inclusive security posture that is both robust and stakeholder-friendly, ultimately fortifying organizational defenses in a manner that’s universally supported and implemented.

When we talk about recognition, awards, and things like that for the Cyber world, no standard or framework says the correct way. This depends from company to company and culture to culture! In the past, I created some metal pins so that the winners of Cybersecurity games could attach them to their shirts or badge lanyards, but there are other ways to do it. As I said, it depends on the organization. Many people make management results visible. They post the effects of training and awareness raising on screens throughout the company, etc.

In my experience this is highly impractical and unlikely, as the CISO cannot reward the risk committee or executive committee, who are the ultimate stakeholders. Rather you can show them the benefits of the decision they enabled to be made and achieved. This is reward for them as it prevents a regulatory conversation about a failed control or successful breach, etc. You should 100% reward the team and the partners who enabled delivery and successful outcomes. But this article is about managing stakeholders, who should in this context, be one rung up from the CISO and therefore on the executive board in an FS organisational model.

Ok let's say just as flowers need sunlight and enriched soil to thrive, your stakeholders and partners require recognition and feedback to grow their support for your security goals.

Building trust and relationships is perhaps the most vital aspect of gaining stakeholder support for security initiatives. Transparency is key here. I make it a point to keep stakeholders informed about both our successes and challenges. This open dialogue creates an invaluable foundation of trust when you need buy-in for new security measures or when things go awry. Listening is another critical component. By actively seeking and valuing stakeholder feedback, you gain new insights and demonstrate that their opinions matter. This fosters a sense of mutual respect and cooperation that can be incredibly beneficial in driving forward security initiatives.

How do you build trust and relationships? By getting to know someone. I once heard a marriage counselor say that the secret to a good marriage is camping. Why camping? Well, the secret to any good relationship is the bond that is created when people survive a challenging experience together. And most of the time, camping comes with its share of challenges. The same principal can be applied to business relationships. Going through a tough experience together and coming out successfully can build a strong relationship and trust.

A lovely comparison I like to make is when you are in cybersecurity, you are hardly remembered until things go wrong. Your role should be to always remind the business stakeholders that your role isn't reactive but proactive in the day to day running of the organization. This also includes communicating potentially bad news but also demonstrating your foresight in mitigating any risk from manifesting. Constantly having training workshops and assisting the different business units contribute to the security program will breed trust and partnership which is fundamental in developing and maintaining a security-aware culture across the organization.

We often spend more time at the company than in our homes, which can be considered a good reason to be transparent in our relationships! We must always think about the company's objectives combined with good communication, clarity and objectivity!

Trust is everything and requires everything at the same time. You cannot earn trust without being authentic - and authentic leaders are unapologetically honest, collaborative, listeners who are laser focused on achieving the company's overall goals. So as you build relationships, come from that space; most leaders you'll directly collaborate with have goals that are seemingly misaligned to your own. Find ways to create that alignment. Then find ways to leverage your skills to help them achieve their goals. Trust will surely follow, and when they reciprocate that connective tissue will ensure you meet your goals with champions behind you.

First, you need to understand what matters most to the business. Until you do this, you are just banging a techy sounding gong to deaf ears. Second, you need to show where all that stuff is and how you are protecting it. Third, show where you are most vulnerable and at risk, centered around critical systems and operations And finally, how prepared are you when something inevitably goes wrong.

Ultimately, if you want stakeholder buy-in and if you want them to have a vested interest in security, then you need to create a formalized governance structure for security that includes leadership and forces the business to own security risk. When the business leadership outside of the security team understands they own the security risk, it changes the entire discussion. Business leadership needs to understand that it is their responsibility if their house is broken into and the root cause was that the locks on the door were 50 years old and had never been changed. Once they realize this, the whole discussion changes.

One thing I found useful is to strat understand the business goals and priorities. Second Translate Business goals to Security language and how to enable the business to continue evolving and maximize any revenue. Third : A gap assessment on where we stand and where we need to go with defined action plans to be revisted periodically with clear ownership. Last but not least two ways feedback from and to the Business.

In the ever-evolving threat landscape, security is a continuous journey. Security teams should: 1. Stay Updated: Monitor new threats and solutions, and relay their importance. 2. Encourage Open Feedback: Value frontline security insights. 3. Be Flexible: Each team has unique needs; customised approaches enhance compliance. 4. Be Transparent: Be open about breaches, detailing actions and future precautions. 5. Conduct Regular Reviews: Continually reassess security goals to maintain relevance. 6. Implement a Holistic Approach: Address people, processes, and technology for a comprehensive security stance.

Trite: look for win-wins. Opportunities to improve the stakeholder's process while implementing the security control help both parties: perhaps the IAM program would benefit from automation as well as implementation of security oversight. Maybe the DevOps team would like to see all issues in their SCM platform (of which security issues are a part).