“Month to month, companies come out with new direction, new tools, new functions, and new features that have to be considered by security. There are so many innovations, and you just have to keep up. It takes a personal commitment and good prioritization processes and skilled people on your team,” he says.
7. Being flawless at the fundamentals
While AI is transforming everything, including how enterprise security teams operate, CISOs can’t let up on any of the longstanding fundamental practices that form the foundation of the security function.
“It’s easy to chase the shiny new object, and there will always be a shiny new object in cybersecurity, but you can’t fall off those basic principles,” says Grant Yacomeni, CISO at tech company Gigamon. “That includes vulnerability management, identity management, cryptography, supply chain management, endpoint protection. Those basic foundational tasks remain important.”
Yacomeni acknowledges that being flawless at the fundamentals — a longstanding core tenet in cybersecurity — is tough. “It’s not easy. Cybersecurity is not an easy career field, it’s not an easy job,” he says.
To ensure he gets the fundamentals right, Yacomeni leans on prioritizing work and building processes, using his Lean Six Sigman skills (he’s a Green Belt) to succeed in those tasks.
“I don’t like firefighting. I don’t want a simple thing to become a massive thing,” he explains. “But it is easier to say that than do it. So developing processes and people [is critical]. You have to lay the foundation with talented, passionate people who want to be there, processes, policies and measuring your effectiveness. And even if your [security function is] mature, the organization and the threat landscape are always changing, so you have to always be making micro-adjustments and improving over time.”
