Neal Bridges

Making strategic decisions is about seeing the forrest, despite the trees. You have to embrace the need to "win as a team" versus "being right". That means that you might have to make concessions to ensure you are enabling the business to take risks. This means you have to have a well informed risk structure combined with a well rounded understanding of the technology at your disposal. Look at it this way - you can't fight a war without understanding your arsenal. You can't defend an organization without understanding what tools you. From there you can look at the people and the processes that support those. Be bold in accepting risk, mitigating it where needed, so that you can play the long game of security.

Like it or not, every cyber security person has to interact with "people" when performing their job. These social skills are important for all aspects of our business - from our reporting, to communicating risk, to driving organizational alignment and change. When building your social skills, look for opportunities to share your expertise in the business. Volunteer in your organization to brief other teams on threats, risks, or educate them on cyber security principles. Write content, either for your job or for the public, that highlights your ability to communicate. This will help you both in the job hunt as well as in your day job.

It becomes really key to be able to communicate with the business on issues like this. The bottom line is you're both right, and so you have to figure out a way to balance the needs of the business with the cyber impact. Ask yourself as a cyber professional if there are mitigating controls or circumstances that you're willing to meet on. Determine if the business has "less impactful" days/times that ease their impact. Do your diligence on testing and formalize your process for patching to reduce the likelihood of negative impact - and make sure you bring the business along with you so they have transparency.

Works with START UPS!! Startups and founders are often out there in the marketplace because they have a sense they can "do it better", and sometimes cheaper. So why wouldn't you at least talk to them and find out if that has realistic and valuable contributions to your business.

Do not shy away from technology innovations! Our industry is often jaded and cynical about technology because we allow the need to satisfy corporate financial requirements (aka marketing) to give us an implicit deny any/any take when new things come to the market. This keeps us safe emotionally, but rarely does anything good for the companies we're protecting or our own ability to see threats on the horizon.

Remember that mitigation is only one aspect of the risk management process. You can also accept the risk. The important part of this decision comes once you have used the information about the threat, the vulnerability and the likelihood to decide which one makes the most sense for your organizations tolerance level.