CISO Conversations: Insights and Expertise from Field CISOs at VMware Carbon Black and NetSPI

CISO Conversations: Field CISOs From VMware Carbon Black and NetSPI

By

Introduction

In a recent edition of CISO Conversations, SecurityWeek had the opportunity to interview two Field CISOs, Fawaz Rasheed of VMware Carbon Black and Nabil Hannan of NetSPI, about their roles and the emerging field of Field CISOs. While company CISOs are responsible for the security of their own organizations, Field CISOs provide security advice to customers, clients, or partners. The role requires extensive knowledge of cybersecurity, strong communication and interpersonal skills, and the ability to bridge the gap between security and business objectives.

Skills Required

The role of a Field CISO requires a deep understanding of cybersecurity across various industry sectors. Rasheed suggests that individuals with previous experience as a company CISO are well-suited for the role due to their comprehensive knowledge of security within a specific vertical. On the other hand, Hannan believes that working as a consultant with clients in different verticals provides a broader knowledge base and facilitates a more agnostic approach to security advice. Field CISOs must focus on providing overall help and advice, even beyond their own company’s products, and must be able to identify industry trends and emerging security challenges.

Soft Skills

In addition to technical expertise, Field CISOs must possess strong soft skills. One of the primary challenges is interacting with customers and partners in a way that is both informative and welcoming. It is essential to navigate tension and potential resistance from customers’ own staff when pointing out security gaps or suggesting improvements. Field CISOs also need to be adept at communicating with leadership at multiple organizations, understanding the business side of different industries, and establishing relationships with mentors who can provide guidance and insights.

Becoming a Field CISO

Currently, the role of a Field CISO is still relatively new and not widely formalized. Unlike the well-established position of a company CISO, Field CISOs do not yet have a clear career path. Instead, individuals often transition into the role based on their experience and the opportunities available to them. Some migrate from company CISO roles, viewing it as a logical next step to leverage their knowledge and experience to help customers and clients. Others, like Hannan, create the opportunity by demonstrating the skills and expertise required and advocating for a dedicated Field CISO role within their organization. Networking, building relationships, and being in the right place at the right time can all contribute to the career progression of a Field CISO.

Advice

Field CISOs are in the position to provide advice to others. When asked about the best advice they had personally received, Hannan emphasized the importance of understanding how the business makes its profits. This understanding enables Field CISOs to implement cybersecurity programs that align with the organization’s overall approach to profitability. Rasheed highlighted two key pieces of advice he received: being visible, impactful, and proactive (VIP) and staying ahead of the curve. Field CISOs need to continually stay informed about emerging threats and evolving security landscapes to effectively advise their customers and clients.

Future Threats

Rasheed and Hannan identified several key areas of concern for cybersecurity in the coming years. These include the increasing focus on hacking smart devices, the persistence of ransomware attacks, the need for stronger API security, and the importance of addressing third-party and supply chain risk. Additionally, they emphasized the potential impact of artificial intelligence (AI) on cybersecurity, both in terms of enabling more efficient attacks and reducing the technical expertise required for malicious activity. Field CISOs will need to stay vigilant and proactive in protecting against these ongoing and emerging threats.

Conclusion

The role of a Field CISO is an evolving and challenging one. It requires a unique combination of technical expertise, soft skills, and the ability to bridge the gap between security and business objectives. Field CISOs can provide valuable advice and guidance to customers and clients, helping them understand their security posture, identify gaps, and strategize for enhanced security. As the field continues to develop, it will be important for organizations to recognize the value of Field CISOs and provide opportunities for individuals to pursue this career path.