The CISO Journey

Gene Fredriksen, Chief Information Security Officer at PSCU, is responsible for the company’s development of information protection and technology risk programs. Gene has over twenty-five years of information technology experience, with the last twenty focused in information security. In this capacity, he has been heavily involved with all areas of audit and security. Prior to joining PSCU, Gene held the positions of CISO for Tyco International, Principal Consultant for Security and Risk Management Strategies for Burton Group, Vice President of Technology Risk Management and Chief Security Officer for Raymond James Financial and Information Security Manager for American Family Insurance. Gene is a Distinguished Fellow with the Global Institute for Cyber Security and Research, located at the Kennedy Space Center. He is also the Executive Director of the newly formed National Credit Union Information Sharing and Analysis Organization. He was as the Chair of the Security and Risk Assessment Steering Committee for BITS, and served on the R&D committee for the Financial Services Sector Steering Committee of the Department of Homeland Security. Gene is a Distinguished Fellow for the Global Institute for Cyber Security and Research, headquartered at the Kennedy Space Center. Gene is a member of the SC Magazine Editorial Advisory Board and was named one of three finalists for the SC Magazine CISO of the Year Award in 2015. He served as Chair of the St. Petersburg College Information Security Advisory Board and the Howard University Technology Advisory Board. He is a member of multiple advisory boards for universities, organizations, and security product companies. Gene attended the FBI Citizens Academy and maintains a close working relationship with both local and federal law enforcement agencies.

List of Figures

List of Tables

Prologue

Foreword

Acknowledgments

Author

Section I INTRODUCTION AND HISTORY

1 Introduction: The Journey

2 Learning from History?

3 My First CISO Lesson: The Squirrel

Section II THE RULES AND INDUSTRY DISCUSSION

4 A Weak Foundation Amplifies Risk

5 If a Bad Guy Tricks You into Running His Code on Your Computer, It’s Not Your Computer Anymore

6 There’s Always a Bad Guy Out There Who’s Smarter, More Knowledgeable, or Better-Equipped Than You

7 Know the Enemy, Think Like the Enemy

8 Know the Business, Not Just the Technology

9 Technology Is Only One-Third of Any Solution

10 Every Organization Must Assume Some Risk

11 When Preparation Meets Opportunity, Excellence Happens

12 There Are Only Two Kinds of Organizations: Those That Know They’ve Been Compromised and Those That Don’t Know Yet

13 In Information Security, Just Like in Life, Evolution Is Always Preferable to Extinction

14 A Security Culture Is In Place When Talk Is Replaced with Action

15 NEVER Trust and ALWAYS Verify

Section III SUMMARY

16 My Best Advice for New CISOs

Appendix A: The Written Information Security Plan

Appendix B: Talking to the Board

Appendix C: Establishing an Incident Response Program

Appendix D: Sample High-Level Risk Assessment Methodology