Related Posts
Conversation Starter
Conversation Starter
Earned Value Management
Additional Posts in Cyber Security Bowl
Anyone ever heard of or worked for Sygnia?
Coach
New to Fishbowl?
Download the Fishbowl app to
unlock all discussions on Fishbowl.
unlock all discussions on Fishbowl.
Subject Expert
Being on the other side as a solo consultant, yes, strategy and advisory are still useful, but more enterprise clients are avoiding the implementation projects from the Big 4 because they are costly and don't work.
Big 4 consulting is changing at a rapid pace and they are going to lose a lion share of business to the doers over the next decade.
Answer: No, not really.
Few enterprises will actually go forward with a bug bounty program that pays enough to solve their problems. Frameworks are nice, but if you want to know where your cybersecurity concerns lurk, pay someone you don’t know to put some pressure on everything.
Yes, it's useful because it lowers the company's insurance premiums
Community Builder
Curious to know what type of companies and how you are selling NIST assessments. It’s how you package your product at the end of the day.
Cyber strategy is useful for sure. If it’s a regulated company and sector, the executives can’t throw it out blatantly. They will need to have risk based strategies and best practice approach to align cyber goals with enterprise objectives. Every cyber solution implementation project supports NIST.
Mentor
McKinsey
Disguised as proprietary crap
Coach
We don’t ignore it, but no one gets excited about audit results. It’s like doing your taxes and finding out you owe money. If you can spin it into your budget requests it gives you some leverage. Thats about as good as it gets. Executives like to point fingers and say I thought this was in place. I thought we were good here. Then we have to remind them it is in place but no one is following the standards.
They can point fingers all they want, but ultimately they own the problem and the fact that they didn’t know the gap exists.
An auditor would see right thru them if they attempted to shift blame. Right out of the CISM material, prob CISSP too.
If you’re just doing a NIST assessment you’re not doing cyber strategy, you’re identifying cyber risk. Cyber strategy combines the business and technology aims of the organisation and cyber threats to define a 3 year plan that enables the business
The fact that you think a ‘strategy NIST-based maturity assessment’ is cyber strategy is the problem and it’s unlikely a roadmap based on this will be strategic, likely tactical and operational.
The general problem with cyber strategists is that we think working with a CISO to achieve a 3.5 or 4 maturity over 3 years is a strategy. Our actual role is to help a CISO to align his/her strategy to protect the technology strategy that enables the business strategy, specifically against current and future cyber threats