The Circle of Cybersecurity: CSEs to Managers

A recent post of mine, The Circle of Cybersecurity,  was a bit dense so I am expanding pieces of it in separate posts.

This post examines the upward arrow that flows from Cybersecurity Engineers (CSEs), the folks on the front lines, to Managers. That arrow is labelled "Evidence" but that is a bit of shorthand for the related kinds of information that travel that path.

In this post we are focusing on large organizations with a Cybersecurity Program (CSP) run by a dedicated staff. We assume that any such organization has a rigorous CSP, based on some formalized principles such as the NIST CSF.

Evidence

In most social situations demanding proof that people are doing what they said they would do is rather rude. This taboo has lead to a dismaying number of CSPs being "faith-based" by which I mean that Managers have faith in their CSEs and assume that all is well unless and until something goes wrong.

Alas, politeness is not what is needed in an effective CSP. In cybersecurity we expect proof and the guiding principle is that if your CSP is working then there should be evidence of that.

"Evidence" is a concept we all think we understand until we need to define it. One of the big steps in implementing a good CSP is agreeing on the compromise that is evidence. There is always compromise because there are limits to what the CSEs can monitor and collect and there are limits on what the Managers can comprehend and absorb. 

Exceptions

All the issues that Managers must encourage CSEs to report are the issues that CSEs must feel comfortable raising with their Managers. See this post for details.

Communication & Culture

Cybersecurity cannot escape issues of communication and organizational behavior because cybersecurity rests largely on human beings and their daily decisions and actions. Achieving relationships in which the CSEs feel comfortable voicing concerns and doubts is not a simple matter. The balance between severity of issue and bandwidth available to address said issue is tricky. Tilt toward "don't both me with details" and early warning will be unspoken. Tilt toward "tell me everything" and early warnings will be lost in a deluge that wastes time on both sides.

Getting this balance right takes time and patience on both sides and assumes a healthy hierarchy that allows enough authority to ensure compliance while allowing enough latitude ensure communication.

Ensuring that your CSEs are well-equipped to do the interpersonal aspects of their part in your CSP is hard. We can help. Ask us how.