From Corporate Guardian to Fall Guy: The Changing Landscape of the CISO Role

The role of the CISO has been on my mind lately, especially after changing roles earlier this year from full-time CISO for one organization, to a vCISO role to provide support to multiple organizations. I also recently posted an article about CISO burnout and mental health challenges that many of us in our role have or are facing.??

When Michael (Scott) Schindler?and I were collaborating on a topic for my keynote a few years ago, we joked that we should name the presentation “How to be the GOAT (Greatest of all Time) and not the ScapeGOAT.” I have always understood my role as the Corporate CISO/CSO. I was responsible for managing cyber-related risk by assessing potential risks for the company and then presenting the assessment to the C-Suite and the Board of Directors, allowing them to make more informed decisions on investments in the cybersecurity program.

Sounds easy, right? Often the CISO proposes controls or technology necessary to strengthen the company’s security posture, meet regulatory requirements, or enable the company to be more resilient when they get hit. When leadership isn’t ready (or in some cases willing) to take actions recommended by the CISO, they find themselves dealing with difficult outcomes such as a data breach or ransomware attack. So, who is at fault when this happens? Is it the CISO’s fault because he or she didn’t adequately defend the company, or is it because he or she was denied the requirements to do so??

Honestly, I knew my job as the CISO/CSO could ultimately function as the “fall guy” if we were hit by a cyberattack or data breach. I existed to take the blame for lack of protection, which would protect the C-suite and the Board from culpability. I could accept this fact in the past. Now here we are in 2023, and after the Uber breach trial, where the CISO has been found guilty and sentenced to serve a three-year term probation and ordered to pay $50,000.* In other recent news, the CISO of SolarWinds was individually named in a class action lawsuit. As I recently shared some data on the mental health challenges we face as CISOs, I wonder if we are really willing to face jail time or heavy fines for our jobs? Will CISOs be faced with the decision to stand up for what is right and lose their job, or support their company and follow instructions from those higher up in the organization, risking liability for the company?

*Important note, I am not offering any opinion or judgement of Joseph Sullivan as I was not on the jury, nor do I have all details of the case. I am using this case as an example of how the CISO’s role has changed.?

Brian Levine at SC Media has made some valuable points in this article. Corporate officers and directors have historically been protected by certain protections including Right of Defense, Indemnification, and D&O insurance policies. For many CISO/CSOs, the “Chief” in our title has held as much liability as the corporate officers and the board members, but not the protection that comes with their positions.

As Levine also points out, “Even the best CISO cannot prevent every breach.” He is right. We can’t control human error, missing controls, lack of support for the cyber program, zero-day attacks, supply chain attacks, nation state attacks, and other potential threats.

CISOs serve a critical role in any organization. Any cyberattack or data breach quickly becomes a company’s problem, not the CISOs. With the lack of talent and the burnout rate with CISOs, it is time we apply the same protections as the other “Chiefs” in the company.

#CISOs #Cybersecurity #RiskManagement #WomeninCyber #WomeninTech #Cybersecuritycareers

?