Paul Baird - FCIIS

To the Question of what EDR solution do I use depends on your specific organisation. I have stood up projects to roll out CrowdStrike, SentinelOne and Defender XDR in different organisations as they had different needs. Some of the Questions you need to ask yourself: 1. Do you need a managed service wrapper in dealing with EDR alerts. 2. What does my infrastructure look like, is it all windows, are there extremely old OS's, are endpoint resources an issue. 3. Cost, 3 different products 3 very different costs. 4. Does your strategy need more than and EDR tool in the future (DLP, FIM,...). Once you have answers to those questions you should be in a better position to pick the right solution for your organisation.

"They design and implement security training and education programs", do they? It really depends on the size of the organisation. A person leading education and awareness programs as well as delivering a security service within the same organisation leads to some conflicts of interest, in my opinion. In those situations, it is better to have a separate entity delivering the awareness and training. The director of security should have input into the awareness program but not the final say.

Are Security qualifications important to a hiring manager? For my interviewing style, I will have to say no. Sure, they demonstrate that you can learn by reading books, but for the seasoned professionals out there who have picked up and read these books, what the books say and what actually needs to be done in real life can be vastly different. I would rather hire somebody who subscribes to, say, hackthebox, has a demo environment at home, and practices what they learn rather than somebody picking up a book and doing an exam. Having 50 letters after your name does not impress me at all unless you can back it all up with experience.

Mother Nature has always managed to change and adapt to her surroundings for millennia, and we, as security leaders, need to take a leaf out of her book and do the same. Being stuck in your ways, using those scary words "while we used to do it that way," is what is wrong with the security world. I am not saying you should forget your past; use it as a base for future decisions. The past 3 years have shown us anything can happen, even if you have worked for the same organisation for decades be prepared to change and adapt.

It amazes me that we are still highlighting diversity and inclusion, like it is a new topic. We have been talking about it for decades. It should be something we do, like breathing. I know that view is the perfect world scenario, and we live from that utopian endstate, but we can only hope. For now, be very aware of biased and unbiased decisions we make. You can't have a functional team with diversity, move away from the typical cookie-cutter approach, and build teams that create conversation and challenges from people with very different perspectives.

Corporate culture and company politics are some of the hardest things to overcome in any organisation. - Avoid the "But I am the CISO" mentality out the gate, as that will not win you any friends or get your strategy adopted. - Understand how the organisation and your peers work; most of what cyber security does affects people's work (IAM, DLP, etc.). We want to do what is right for the organisations without upsetting business flow (too much). - prepare your organisation for the changes well in advance to allow teams to adapt and change long before the change happens. - Listen, listen, listen is my final piece of advice.