Leadership is influence, and relationships play an essential role. To ace your performance appraisal as a security leader, you need to develop healthy relationships with the internal security team, organizational peers, management, vendors, and customers. How can CISOs build their relationship capital with all constituents to enable business growth while keeping the fort secure?

Contributor

• • Rob Hornbuckle, Chief Information Security Officer, Allegiant

Transcript 

Sanjog: Hello and welcome to CTN to learn more about the show please visit www.ciotalknetwork.com and today’s topic is Building Your Relationship Capital as a CISO, which is Chief Information Security Officer. So we all know that leadership is influence and relationships of course play a critical role in building such influence. So what are CISO’s able to do in terms of relationship building with the various stakeholders, which is their internal security team, the folks who are from their organizations, their business unit leaders, the upper management, the vendors, and even the customers. What have they been able to do to build such relationship capital, so they can directly contribute towards the business growth while fulfilling their responsibilities to keep the Fort secure, to discuss this, I have with me Rob Hornbuckle, who is the Chief Information Security Officer with Allegiant. Hey Rob, how are you?

Rob: I’m doing okay. I did notably notice that you were missing the board of directors as well on that list.

Sanjog: There you go, so you added the missing link, if you will, right? so we will add that into the mix as we go about having the conversation. So, you know what let’s kind of set the stage, when we talk about relationships, of course, you know, leadership one on one says we’ve got to build relationships with all those different people, but invariably, when you come in and the people who you want as champions are the very business leaders who have agreed to what you have to say and what you are  showing them as the path ahead, then they may follow you even become your champions and pave the road for you to be able to do what your job is, so that’s great said, but, lot many CISOs and lot many companies report that that type of camaraderie is still in the making or is not reaching where we want it to. So, what do you think is he missing link here are the missing pieces?

Rob: Well, it’s not so much, like it’s a missing link as much as it’s just a change in attitude for the people that are in leadership with insecurity roles. There’s a lot of comparison similarities if you look at the CISO role now, as if you looked at the CIO role 20 or 30 years ago. They are very technical positions at that time, and most all the leaders in it come from security. I mean, rightfully so, it’s a pretty complicated subject to understand otherwise, but you’re trying to utilize these skills at this level that you’ve never previously had to utilize within your career, it just wasn’t necessary when you were doing security analyst work or heavy in the weeds on figuring out the technical details or red teaming or purple teaming or anything along those lines have those particular soft skills business skills or people’s kids and as you rise in ranks through manager, they’re still not necessarily all that needed, though you do start running into them a little more, but then when you start getting to those director level and above type positions, it really becomes necessary and it’s just not something that was done on the regular course of everyday business prior to that in most people with insecurities career growth.

Sanjog: Now when you have seen people trying to do an I like your comment about people may not have seen this happening before they have never been groomed, to build relationships but it’s interesting that the journey of anyone who is from starting from an individual contributor to a team lead to a manager and or to a leader as a CISO, did they not have to build relationships in some ways, anyways, for them to grow because they could not have just run fast and alone.

Rob: A little bit, but it’s not like nearly necessary to the same amount. All you really have to do is show scale at what you’re interested in and be really good at doing things within information security to garner that respect and it’s very easy to build those kinds of relationships when you’re talking about people that are very much like you, that very much work on the same things that you have, all these built-in commonalities with, and that think about the same things on a fairly daily and regular basis. So those relationships are very natural, very conducive, very easy to go about doing and very easy to move into those roles in those positions with also you work with them on a much more regular basis. So the skills necessary to work with people that don’t do things the same as you, that don’t have nearly as many commonalities and that you don’t interact with nearly as regular are the skills that are mostly missing, when you’re talking about it from that angle.

Sanjog: Now, I’m sure you’ve paid your dues, you’ve gone through the journey. You’ve had your bruises and alibis, what was that like, what made you to who you are today and how well do you feel you’ve mastered this art of relationships?

Rob: I call it cutting my teeth. I cut my teeth hard.

Rob: And in my instance, so I started security around the mid-2000, I’d been doing IT for multiple years prior to that. I started picking up security things, I enjoyed it, the company I worked for, I helped build out the security program underneath the CISO there and eventually I had to move on when Oracle bought the organization because Oracle lays everybody off in IT, when they do that, it’s just kind of what they do. But at that point, I was really young in my career and I was put into a leadership role for a small mom and pop company that had about a thousand employees all around the United States that never had a security program and they put me in as their first and only security person to build out, create and lead their security program because they were trying to land much more cloud full, I guess you could use a made up word, clientele. In this instance, they were trying to land clients like burger king and McDonald’s and things like that and they really wanted them to have a security program that land those contracts. So they brought me in to build that program, I had experienced building a program, I knew technically everything that I was doing, I knew how to get them all the certificates they needed, where they needed to go, but I didn’t have any of those relationship building skills and I didn’t really have too much in the way of leadership skills and I was just thrown to the wolves, a better term that, that cutting your teeth mentality we just referred to, I learned really quick, where walls come up, where things don’t work, where it seems like you have the best business plan and the business case you’re wanting to do exactly what they asked you to do and you just keep hitting all these walls and you don’t understand what’s going on and it was a very painful experience. Ultimately, I did do my job. I got them several certifications, I helped them land the biggest client they ever got, which in this case was actually burger king but it could have been done in a third of the time, much more smoothly and probably been a much better program had I had the skills now that I needed back then. The things that became really evident to me with two fold, one was this relationship piece that I’m referring that we’re talking to now and the other was a true and solid understanding of business. I’d come from IT like a lot of people within information security, so I understood the business of information security, but I didn’t really understand greater business models. So personally, I went back and I got my MBA and I went heavy into understanding the business aspect of everything and then I started working on those relationships skills and the business piece really ties in because when you start working with those other senior leadership and even board of directors, that’s where they’re coming from. There’ll be a slight skew, according to the area that they’re in finance or legal or operations or any other part of the company, they will skew it a little bit. But once you have a full comprehension of that business piece, it gives you that connection and you can talk to them, not as a security person, but as a fellow officer of the organization and you can talk to them about their pieces and how their pieces affect the business and you can contribute, it’s kind of like being the CISO brings you to that table where the other senior leadership people are. But what you do when you get there is going to be completely dependent on your capabilities, your knowledge and business understanding and how well you can establish those trusted relationships.

The second part that I did personally, in order to do that beyond the MBA is I went out and I got an executive coach. I did some testing, I figured out where I needed to work on things. I got an executive coach, I worked on them very hard. My wife, it gives me a hard time about it, she actually made a couple of comments about how, he’ll tell me something and then show you, because she had told me the same thing three years ago. If he tells me it means more than if she had told me the same thing. So that’s always entertaining, but it taught me a lot about how to establish those business relationships and how important they really are by learning how they work and how they’re established and then from there, it’s just working on creating them and a lot of it’s really simple and I know it’s terrible to say that, but you’re just, you’re being genuine. You are showing an interest in both where people come from a personal standpoint and from a professional standpoint, which is where that business knowledge comes in place. So you understand where they’re coming from professionally, you’re supportive, you don’t criticize in a terrible way. You constructive with your criticism or just being constructive and feedback and not even confront considering it as criticism and just work on establishing those trusts in those relationships. Another good example is I’ve been asked this question before, it’s kind of a famous question within the CISO community, actually, if you were stuck on an elevator with your CEO and you had 20 floors, that elevator was going up and then he was going to be gone. So you have 30 seconds or so maybe a minute, if it’s a slow elevator, to try to communicate with them about information security, what one or two things would you really want the CEO to understand about information security that you would communicate in that time and how you would do it? And lots of CISOs talk about that paradigm all the time, I fundamentally disagree with that because if I was in that particular circumstance, I would talk to the CISO about his family, talk to them about how the business is doing, keep up with where the business is doing. So I can do that in those particular areas, further deepen the business relationship that I have with him, because the moments and the times that you have for doing those kinds of things with peers of that level are significantly rarer than the times where you try to explain a technical information, security item to them.

You’re going to be given the opportunities to explain those technical items to them, if not, you can always create them. Those are really easy ones to create as well, which we can do a different talk about if you want, but save the times where you need to talk about those things to when you talk about them and don’t be bringing them up all the time of, do everything that you can to avoid the mentality of people looking at you and thinking of you as, oh, that’s the security guy, and he’s necessary or he’s our insurance policy is terrible when that happens sometimes and you don’t want that particular reputation, so you need to avoid it as well as trying to establish those relationships. I think I started meandering and storytelling a little bit. I’m not entirely certain I’m even at where your first question was.

Sanjog: No, in fact, this is a beautiful story of your own making, which you’ve done and you know, of course you’ve gone through your own, you know, pitfalls or things that you learned along the way of what works and what is the best way for a budding CISO to groom his own him or herself. So that definitely tells on what your journey is, and I’m sure listeners will learn from it, now, what you essentially said is you’ve got to be relatable someone who is also human first and not come across as, you know, a geek, if you will, who’s, you know, throwing three-letter acronyms for security, I totally understand that. Now that part is good, now at the same time security, as you came in, and like you gave your example and many other security leaders will tell is that they were thrown into a situation, they had a skeletal staff and maybe there was no other security leader who was ever there, the IT person was somehow wearing the security hat and when you come in, you kind of inherited a mess or something close to it and then since they start investing, while you can be the nicest person on the planet, but they also need to see if you can deliver and you’ve got to build that trust. How does someone go about doing that?

Rob: So, you work on those business relationships and you establish expectations. When I go into every organization I’ve ever gone into has either been me starting it from scratch or inheriting a mess or a mess of some sort, either reputational or technical and you can’t go in swinging a big sledgehammer around trying to fix stuff right off the bat. I don’t do hardly anything as far as alterations to the program for that first month, the first month is all about asking questions and listening. You’re accomplishing two things through doing this, so you set meetings with every senior executive that you can at the organization, depending on the level that you’re at or how you were brought in, you can, that can be somewhat limited. If you’re brought in as say a manager and you’re in charge of all security, you’re not going to be able to get a meeting with the CEO or maybe even the CFO. But if you come in at a director or VP level, you would be able to get those, so you should schedule all the meetings you can with as many of the leaders as you can, that you have the capability of doing based on how you were brought in company and during those meetings ask very simple questions and listen a lot more than you’re talking and the questions you ask along the lines are, what does security mean to you here? What have been the biggest roadblocks that you’ve seen in security and how can I help you in security to better do your job for the company and just listen, it accomplishes a couple of things, it helps you learn more about these people, who they are, what their personalities are, the context around, how they talk, how the communicate and interject small interpersonal things with them, create conversations to also begin establishing those business relationships with them as well and then that’s, what’s truly going to get you a good idea of what the state of the organization you’re walking into is because everything they told you on the interview is going to be jaded in one way or another in some direction, until you get input from everybody that you can at the organization, have a good idea of what’s going on, then you’ll have a good idea of where you need to go, where you need to start what you need to fix and how to go about doing that in a way that best supports what the business’s objectives are going forward. A good example is, obviously, you should be starting with some sort of framework, even if that framework is the lack of a framework, that’s still a framework. It’s just depending on your organization, that may be what they need and these meetings will help you determine what the organization needs. You don’t want them to be doing this if they plan in the next three to five years to move into Europe, for example, you’d be wanting to look at something like an ISO, unless they’ve determined that they want to start trying to do business with the U S government here before they move into Europe. Then you really want to look at doing a mist and this kind of business, directional information you’re not going to get, unless you put in the time to find it out, ask the right questions to listen more than talk and establish those business relationships.

Sanjog: Let’s take a quick break listener, we’ll be right back and let’s talk about the internal security team, the one which you would develop from scratch, perhaps do something to keep them around because of course, this is a very on in demand skill security teams are, or security experts are very hard to find and then while they stay, you still have to build and nurture those relationships so that they always stay top of the game and able to field all the different challenges, that security field bring, how do you do that? What works? What doesn’t work? What is the secret sauce? That any CISO can use, please stay tuned, we’ll be right back and explore.

Sanjog: Welcome back, so Rob, when you look at building and maintaining and nurturing an internal security team and having relationships with them so that they would go ahead and deliver the impossible, which typically security teams are cask web. It requires a certain talent from the CISO and any other security leader. What would you say would that be, especially when you see security teams, they are premadonnas or they are Uber geeks or they are nice people, but they have personalities. What do you do for that?

Rob: Methamphetamine, no, I’m just kidding, really it’s a matter of developing the team, again, I hate to beat a dead horse here, but I, you fall back on a lot of the skills that I actually picked up later in my MBA, the reinforced, some of the stuff had learned coming up through IT Infrastructure in security. You learn about each individual person; you can’t treat everyone the same, you can’t manage everyone the same, you learn about who they are, what they do, where they want to go, how they fit in, where the personalities are, where their strengths are, where their weaknesses are, and then piece everything together like a puzzle.  When you’re hiring people, when you’re building a team from scratch, that’s really easy to do because you’re kind of starting from the beginning, you can easily set it up. When you come into a pre-existing team that starts to become a little more difficult, hopefully you’re coming into one where the personalities have already meshed, there’s a lot of group dynamic type things that you learn about during an MBA program. When a group starts to come together, it’s the storming phase, and then there’s forming phases and all these different phases of group dynamics and basically you’re trying to shepherd them along those phases, making sure that they all can work conducively together. As far as premadonnas and those particular pieces, you just need to figure out who’s who and what each person needs and make sure that you’re there to give them what they need so that they can be successful in their role.

When you’re talking about the people that directly work for you, I’m a big advocate of what’s called servant leadership, it’s my job as the leader of the organization to ensure that all the people that are working for me have what they need to be successful to get the job done and in essence, then when they get the job done, I’m successful in my role in doing that. As things and time moves on doing those kinds of things, you’ll naturally develop those relationships within that department, those business relationships to further push that goal in that direction.

Sanjog: So based on all the things that you mentioned about mentoring and, or helping groom them and build relationships, they are well, outlined by you, but where do people go wrong? Because this advice is good advice, but it doesn’t get executed or it doesn’t get executed well and that’s why you see constant chaos, so where are people missing the boat or where is the disconnect here?

Rob: By doing what my kids do, saying, okay, thank you, and then doing what they want to do anyway. Exactly. It works out to be, it’s actually fundamentally doing those changes and some of it is that change level between individual contributor and direct line manager and the change that happens from there into that director level and a lot of people can’t let go of a good portion of that control, which can be a really big hindrance to having that particular cut-over. 

Micromanagement, especially with security is never going to be successful and then beyond that, it’s just making sure that you’re doing what needs to be done so that the people underneath you are accomplishing what they want to accomplish. Another, we hadn’t started talking into it so much, but there’s a shortage of people within information security. Everybody in this field knows that I don’t know if everybody outside the field knows it. I think I have conversations with HR every once in a while about it because they forget, but there’s a ton more jobs than there are people, especially at the individual contributor level. Maybe not as much at the leadership levels, but at that individual contributor level, definitely and if somebody doesn’t want to work for you, they can choose to not work for you and go get a job somewhere else pretty easily, which may or may not be a good thing, depending on how the dynamic works within your organization. You need to garner this reputation for you personally, as a leader and the company that you’re working for as being a growth place for people within the field. It’s a bit of a different mind-set than what most people would come in to this as, but you’re not there to hold onto people, you’re not there to keep people working for you forever at the best performance that they could ever particularly meet and you’re not there to use people up and burn them out and let them go and replace them with someone else to do the same thing with later. You’re there to grow them, to teach them, to mentor them to get to where they want to go and if where they’re wanting to go is then somewhere else within the company, that’s great. But if it’s not, then you get them ready for whatever their next job and their next opportunity is and start garnering this application or that, wow, man, that’s the issue just went whack for a second garnering this reputation for being a place that does that. And in that way, you’re always maintaining a certain level of skill and talent at the organization, even if you’re not retaining necessarily the same people.

Sanjog: Now, one is to, of course, work with the people who are reporting to you, of course, there could be tough nuts to crack, but you will have some leverage to some extent, but now comes organizational peers. I’ve spoken to many security leaders and if I asked them the question, hey, do you know if your organizational peers are aware of what are their crown jewels?  Do they give you a ready list and an always updated list of what their priorities are? The answer is emphatic no, and that could be partially because they don’t feel it’s their job to take care of security of their own division or business unit per se and secondly, in many cases seems like that many of the security leaders go only on demand to them to say, hey, what do you want?  I’ll deliver it to you so, I just wanted to give you this background, so suppose I were to say, okay, let’s do a reset and if we were to go ahead and start from scratch, building relationships with organizational peers so much so that the CISO always, has, an always updated list of crown jewels, which are important to organizational peers and there’s a collaboration which allows them to understand how security will help them. Then the relationship will automatically blossom out of this constant interaction and empathy and understanding of each other but some of it doesn’t happen, what are we supposed to do in this way and in this disregard?

Rob: Develop soft skills, most of the time, if it doesn’t happen is because of a lack of trust. As far as the crown jewels, it really isn’t necessarily their job to understand what their crown jewels are unless you’re talking about the CEO or some of the very senior leadership people, they should but if you’re talking about lower level leadership within the organization, they don’t really because for lack of a better term, it’s not what they’re graded on and it’s not what they pay attention to, it’s your job in security to understand where all the crown jewels for that company are and you understand those by talking with those more senior leaders and getting a good idea, what the business model is for the company, what your differentiators are, how you distinguish yourself amongst your market. What you need to know in order to establish those crown jewels. Are they data related? Are they IP related? is it customer base? It there’s all kinds of different things that it could be, and you need to determine what they are working with their senior business leaders, because what’s important for the success of the ultimate overall larger business is what your crown jewels could be. If you start asking those lower level leaders, they’re going to tell you what’s important to them, which may not necessarily be what’s important to the overall company and there what could be as well it just depends on how developed they are as being a good leader within their area, which you can’t completely rely on when you’re trying to make sure that you’re successful. Otherwise, you’re taking more risks than you really need to in the success of your role. Once you’ve established that, it’s just, you need to push forward to establish the goals of the organization to support the business model and the business objectives and those goals of that organization and you’re not going to go wrong if that’s what you’re doing, the problem comes into play when you start viewing it more, as this is my personal objective, this is what I think the company needs, and I’m going to do everything I can to ensure that it happens. If you have to be gearing, everything to be supporting the business in one way or another, be that regulation or differentiation, or just ensuring that the crown jewel pieces are kept safe and there’s lots of different mentalities and things that you can use to do that. It’s going to completely depend on the sector within the industry that you’re working for, so for example, medical is going to have completely different needs than restaurant than airline, then government sub-contracting and telecom. I’m just naming all industries that I’ve worked at in the past but they all have different stressors that affect what they really need from a security standpoint and I could start playing into how this establishes the risk and the risk acceptances and all of those risks pieces, which everybody talks about that right now about how the mind set needs to shift so that you’re risk-based within IT, or risk-based with insecurity.

I would say that yes, risk is part of the language, but that mentality really needs to change more so that you are business centric and business focused and if you don’t really understand business, the easiest way for a security person to go there is to initially just go to risk, and an understanding of risk because it’s so conducive to our industry. But it’s only a part you’re only doing a piece, you only see a piece of the picture when you’re doing that, and you need to be able to expand it, to see that whole frame so that you can properly set about the course of the program and so that all of their senior leaders and understand that you see that whole frame, the whole frame that they’re looking at and that you’re on board with them and then you start developing that trust and then when you say things, they start to carry more weight as long as you don’t start threatening things, cause that’s always going to be back.

There’s a point I call it’s one of the inflection points that happened within my career, this is my fourth CISO role that I’ve been in and I’ve learned a lot as I’ve gone across all the different CISO roles before I came here and my second role, I ran into a lot of roadblocks that I just, I didn’t understand and I was running into him at that other manager level. So I came to understand, or I’ve started wanting to figure it out so I started petitioning feedback meetings from several people that I work with that I’ve used peers, basically, just asking them to tell me about my performance and the things that I could do to better support them or areas where I may not be meeting what they think their expectations are kind of the same things I was talking about doing when you start at a company, , obviously I didn’t do it when I started that coming to then learn that yet. So I started doing that then and that’s part of how I realized what that really was and I heard some advice at that time. It took me probably about a year to process because at the time I was really upset, I received that advice, I didn’t want to hear. But this senior leader, he was a vice-president of the company at the time was trying to explain to me why I was getting these roadblocks, that I just didn’t understand and he told me, you need to realize that, every one of the senior leaders at the company views the organization, like you would view your child. They’ve been here for a very long time; they’ve nurtured the business, they’ve raised it, they’ve seen it grow, it’s like a child to them almost and they have to have the same faith and the same trust in you that you would have in someone that you would have watched your child, for them to really start trusting and taking seriously in the ways that you’re talking about moving the business full.

Sanjog: Let’s take a quick break listener, we’ll be right back and partners that’s what we should talk about because any security leader knows based on how the landscape is changing for security and the flavours of breaches and other types of threats that are coming up. There’s no way CISO along with their internal team, it’s, you know, I should not say no way, but for the most part, they will need some partners wherever possible, and the tools and service providers, but then you’re only as good as the relationships with these people, for them to step up and work beside you to fight all the threats that you have to deal with. How do you do that? How do you nurture these partner relationships so that they step up, when you need them? Please stay tuned, we’ll be right back and talk more.

Sanjog:  Welcome back, so partners, service providers, solution vendors they are, it’s very critical to any security leaders, but then it could stay a vendor customer relationship, or it could turn into a partnership where service providers and solution provide actually come, listen, do what they have to do, to give ammunition and the tools and the arsenal for security leaders and their team to be able to do their job. What does a good relationship, how do I define a good relationship between a CISO and his team and the service providers and solution providers, and with that as the benchmark where people fall short and how to sell it right?

Rob: Pointy Sticks, now the best way is to treat it like they’re in a member of your staff and I’ve worked at organizations. Now I’ve set things up where I’ve used outsource and managed, managed providers and different vendors for different things, all kinds of different models across the companies that have worked for and unless they’re just simply providing you hardware at discount rates, if they’re actually doing any work for you, you have to establish both the contractual relationship and the working relationship and one, that’s going to be conducive for long-term success. So contractually, you need to have SLA as established a lot of them don’t really want to have them there, but you need to have SLAs and they need to have some kind of teeth and you need to make it so that you’re not a Nazi about it either.

If they barely miss one, don’t enact just because it’s in there and you could say recoup 5% of what their charges are because they missed for the first time in a year, don’t do it. It’ll pay much more in the long-term benefit of increasing the relationship with those people and then it would the little bit that you would get back, but those SLA still do need to be established, so everyone knows the grading score, the rubric, if you will, of how you’re grading their performance of the organization. Beyond that, it’s establishing those relationships again, but how do you establish a relationship with a company and even if the Supreme court says that there are people there, they’re still not people, you need to figure out a way to do that and the best way in my experience for doing that is having a dedicated liaison person. Most of them will do this anyway, and they’ll establish a liaison person, who’s, this is your point of contact at our company for doing things. But that person, you want to establish a regular cadence of communication, where you’re not just talking about simply what their company does for you and the things that are salvaged, but find out about them as a person and treat that contact like you would an actual employee who works for you, figure out who they are, where they’re going, what they want to do, what their goals are, everything about them as an actual person. Just view it as their workload is much more than a single person’s workload because they’re representing the entire organization underneath them and establishing that relationship will ultimately lead to them being more open, more honest, even going the extra mile at different times beyond what your contract may be for what is necessary for your company.  At the same time, you also, I’m assuming you have a NDA in place with these people because you’d be crazy if he didn’t, but you have to be open about what your business objectives are, what you are really looking for out of it, the relationship, what you really need them to do to ensure that your successful and that you do things. In essence, you’re kind of showing a vulnerability a little bit at more to them being vulnerable in that particular situation can drastically increase the relationship that you have with them and I don’t mean vulnerable like don’t create an admin account with no access restrictions and give it to them.

I mean, be vulnerable in your communication and with what you talk about with the organization and be fully open and honest and establish that two way working relationship with them, where, you know, all of what they’re are, what their restrictions are, where they’re at, what political issues could be in their particular climate, assuming they’re outside of the US and what you need from them to be successful at your company and what they need from you and once you’ve done that and you’ve created this two way working relationship, they basically become just like they were a member of your staff. Just that one member of your staff performs the work that maybe 20 people could have.

Sanjog: With the customers, everyone like in business, IT leader, and of course, business leaders, they have to work with customers on the surface it might look farfetched for you to build relationship as a CISO with the end customer, but it also makes logical sense because if you knew what the customer wants and if the rest of the organization is rallying around what the customer wants, why not CISO, why should they be couple of layers down. But it doesn’t happen, but it should, I mean, at least to me, it looks like it should. What are your thoughts and if you at all feel, there’s a way for CISO to be able to directly build relationships with customers and as a result, drive value for the business, what would be that way?

Rob:  Well, it depends a little bit on your industry, for example, if you’re doing government subcontractor and your customer is the Navy, then it’s not necessarily as important but if you’re in a regular normal customer facing consumer type business, then it does make better sense. If you’re in a business to business type organization, it completely makes better sense there. From a normal consumer type operation, you are the public face of security for your company, you may not be out there as much as some of the other leaders at that company at least not right now, that may change because security is starting to become so much of a bigger thing everywhere across the country. But you are that public face of security, when someone looks up security for your company, they’re not going to be looking at your CEO, they’re not going to be looking at your CFO, they may look a little at your CIO, depending on how knowledgeable they are, the subject, but most people are going to be looking at the CISO and having a good public presence is going to become important for the role, just like it would for any other senior leadership type position that exists out there. From the business to business standpoint, you’re going to be doing a lot more interactions with your customers because your customers are, or other organizations, your interaction with them is most likely going to be with their risk type arms, because they’re going to be doing audits and things of that nature to figure out what your security posture is. I’ve gone through so many audits, it gets kind of crazy. I’ll tell you the U S Navy does a lot of auditing, he started doing work involving them. But you become that face that way, yes, you could delegate it down to someone that works for you because it is kind of monotonous, but yeah. If they’re bringing in someone of a certain level to be involved in those meetings, and then you should be there as well to be the security face for the organization to help establish that trust with your business customers, that you are of an adequate level of security that you do take security seriously, that you’re knowledgeable of it and that you can start building that particular trust. From that consumer side, it’s going to start being part of public image, work with your corporate communications department or whatever name your organization happens to have for it, work on a public profile, a public presence. The public face of security is the CISO for a company and if somebody is concerned about the security of an organization and they look for the CSO and they can’t find anything about them or they can only find a no picture LinkedIn account and that’s the extent of it, then it doesn’t inspire as much confidence from a consumer standpoint as it would otherwise. Yes, it’s not super common at the moment, but that is the direction that I believe things are headed.

Sanjog: Now, one final question about the leader, him or herself as a CISO. So, if I were to say, what are the categories or rather the attributes of a good leader? Oh, well they are genuine, they’re confident, they’re humble, trustworthy, positive, fun all of these things we understand and it’s like leadership 101 these are the attributes but if someone is truly trying to, as a security leader, build and sustain a substantial relationship carp capital, what more would you recommend they should have?

Rob: Public speaking is very important, being able to communicate clearly and concisely and in a way that’s somewhat entertaining. I know it’s weird kind of saying entertaining,I know, I don’t mean like you’re sitting up there with a top hat and a cane and doing a dance or anything, but learning to talk in very tones, not being a monotone speaker, kind of this, the stuff you would learn in basic acting courses on how you communicate with large audiences can be very helpful as well, just not necessarily because it’s completely necessary, but because the opposite is a hindrance. So you’re removing those particular hindrances.

Sanjog: Now, if you look at yourself and as your journey happened and if you had to benchmark, where you’ve reached with your relationships, what would you do to where you are to keep upping your game as the relationship person?

Rob: Not start a new job right before COVID. (Jokes)

Sanjog: Okay. So do you think going remote would actually create a challenge for anyone who is trying to build relationships? Have you actually, would you place any value given this is the new normal, right? would you place any value to people seeing face-to-face shaking hands, hanging out at a bar if you will, to build?

Rob:  Yeah, it’s definitely valuable, everyone did this whole work from home shift when COVID happened and my team just like many, many others out there, when we initially shifted to work from home, we had a decent performance boost and teams performing better than they used to. But they also have all of those relationships priorly established from working together in the office for so long. So it’s an easy transition for them to go to a work from home environment. If I was to start a brand new team that never had that, and everyone from the beginning was working from home, it’d be very difficult to establish those relationships. I’m not saying that it isn’t possible, I’m saying that we need to rethink how we’re doing things if that’s going to become the new norm long-term, because that face-to-face relationship building process for your teams is very integral. So you may just have to do events more often, you, instead of doing a once a year party event, you may have to bring everybody together once a month or once a quarter, depending on how far they are away and find ways to create those face-to-face exercises without an office in existence, or, I mean, obviously you could go back to the office too, but I don’t know how all that ultimately played out in the end.

From a senior leadership type role, the face-to-face is a hundred percent necessary, there is no way to establish the relationships and the trust that you need without those face-to-face interactions. Again, like with the individual contributor teams, if you’ve pre-established them, and then you go to work from home, you’re not going to run into nearly as many roadblocks or any problems with it, but you really need this face to face interactions to establish. I joke about it, but I was blessed enough to have actually started on January 1st, 2020 in this particular role, so I had a good two and a half months of doing that before we all got sent home. So I was able to establish all of the relationships that I really needed to be successful. Could I have been more successful, had we not have all been shifted from home? I, absolutely, I’m a hundred percent positive, I could have been more successful in my role and more successful than I was able to do if I could have established those relationships better over the course of maybe four or six months, instead of just the two and a half I was given.

But even with what I had, it was enough for me to get there, had I started simply remote from the beginning it’s going to be a massive uphill battle to get those relationships established because the small uncalculated, unscripted interactions that are the biggest builders in relationships, the bumping into each other in the hall, the small talks, while you’re at the vending machine, trying to get a drink or a snack or running into each other in the parking lot type thing don’t happen and those are the times where people are most comfortable and not talking about work things with other people that they’re run into, it’s just they’re small talk moments or if we go back to that story from the very beginning, that’s your 32nd elevator ride. How are you going to run into your 32nd elevator ride with the CEO of everybody’s working from home, if, those events just aren’t going to happen and they become such a necessary part of senior leadership to develop those relationships and to develop that trust.

 Sanjog: Once again, thank you Rob, for sharing your insights about how the Chief Information Security Officers can build a substantial relationship capital. Thanks once again.

Rob: And thank you very much for having me here, it was wonderful to speak and I wish all the listeners, the best of luck in their endeavours moving forward.

 Sanjog: And listeners, please like us on social media, subscribe to our podcast as well as keep listening to us and keep giving us ratings and so more people discover us and benefit. Thank you again for listening to CTN, this is your host Sanjog Aul till next week, take care and God bless.

 Advertisement: Thank you for tuning in to CTN CIO talk network with your host Sanjog Aul, to learn more about our program or for show archives, comments or questions, please visit www.ciotalknetwork.com. Thank you again for listening

Download Podcast

Apple Podcast, Google Podcast, Spotify, iHeartRadio, SoundCloud, TuneIn, and Stitcher. Find other syndication channels here or search CIO Talk Network podcast on any other app.

Explore More

• • How to Prepare and Pivot for the Privacy Regulation Pileup – A CISO’s perspective of what’s beyond GDPR and CCPA
  • Delivering on the 2021 CISO Agenda
  • Addressing the top three CISO challenges
  • CISO as a Digital Business Leader
  • Rethinking the CIO – CEO relationship
  • From the Basement to the Boardroom: From CIO to CEO
  • Remote Working – Call for a Modern Leadership?
  • Does the CMO really need a CIO?
  • The CIO as a Venture Capitalist
  • A CIO’s Performance Appraisal