Tenable Blog

When Gartner Vice President Peter Firstbrook took the stage at this year’s Gartner Security & Risk Management Summit, he spoke of two shifts in security: resilience and trust. Organizations must develop resilient security programs that anticipate disruptions and enable them to respond quickly to avoid costly lapses in productivity. He also championed trust within the organization, as opposed to traditional restrictive security controls.

CISOs too often focus on numbers and metrics that are disconnected from the strategic mission of the business. Cybersecurity can add value, however, by looking past the numbers to the steps being taken to facilitate a safe execution of business strategy. 

The secret to success as a CISO is forging relationships

According to the Trends in Security Framework Adoption Survey, research conducted by Dimensional Research on behalf of Tenable, adoption of security frameworks is at an all-time high. Your organization might adopt a security framework for many good reasons, including:

Tenable recently sponsored the publication of an ebook, Using Security Metrics to Drive Action. This ebook is a compilation of thoughtful essays from 33 CISOs and other experts, who all share their strategies for communicating security program effectiveness to business executives and the board. Their first-hand experiences are insightful and offer best practices that you can implement in your own organization.

Imagine you’re standing on the beach with your boss. He hands you a ruler and tells you it’s your job to measure the ocean and make sure that it stays within acceptable parameters for “ocean safety.” You’d probably think he was crazy. A ruler isn’t the right tool to measure that vast and constantly changing environment. Furthermore, what metrics could you possibly collect that would have any bearing on whether or not the ocean was “safe”?