The Security Leader’s Communication Playbook

Jeffrey Brown is a recognized information security and IT risk expert with a strong track record of more than two decades implementing cost-effective controls for global Fortune 500 financial institutions, including Citigroup, Goldman Sachs, GE Capital, BNY Mellon and AIG. He is currently serving as the first Chief Information Security Officer (CISO) for the State of Connecticut. Jeff is active in the information security industry as a frequent speaker at various events and conferences and is the author of multiple articles and publications. He co-Chairs the Evanta New York CISO Executive Summit and works in an advisory capacity with various events, including the Cyber Investing Summit. He is a board advisor and mentor for iQ4 in their Virtual Cybersecurity Apprenticeship Challenge, which aims to prepare some 10,000 students for the workforce and help address the security skills shortage. Jeff holds a B.A. in Journalism with an English minor and an M.S. in Publishing from Pace University. He holds multiple security certifications including CISSP-ISSMP, CISM and CRISC.

Contents

Preface xvii

Acknowledgments xix

Author xxi

Introduction 1

Part 1 Communication Foundational Skills 13

1 Foundational Communication Skills 15

2 People Skills 43

3 The Language of Business Risk 59

4 Company Culture 79

5 Better Business Writing 93

6 Say What? Verbal Communication Skills 119

7 Communication Superpowers 157

Part 2 Communication in the Real World 183

8 Policies, Standards, Guidelines and Procedures 185

9 T raining and Awareness 203

10 Driving Change through Metrics 217

11 The High Stakes of Incident Response Communication 235

12 Communicating with Your Team and Colleagues 249

13 Managing Up: Finding Your Boss’s Communication Style 269

14 The Board of Directors 279

15 Working with Auditors 295

16 Your Next Job 305

17 Consultants and Sales: Building and Maintaining Client Relationships 325

Appendix 341

Index 361