The Most Influential CISOs Of The Year 2024

1. VOL: 01 ISSUE: 01 2024 2024

4. ur world is more linked than it has ever been, and there is an incredible quantity of data and O information available online. Although there is no The Cost of denying that this interconnection has led to amazing developments and conveniences, it has also exposed us to Convenience in fluctuations and new hazards. The growing advancement of technology has made cyber attacks inevitable, thus making it imperative for both individuals and corporations to Cyberspace is prioritize cybersecurity as a critical business requirement. Eternal Vigilance Consequently, the digitalization of our daily lives has not only revolutionized the way we work and communicate but Against has also given rise to an expanding global cyber threat landscape. No technology or piece of information Compromise connected to the internet is immune to potential breaches. As our dependence on technology grows, so does the sophistication of cyber threats, ranging from malware and phishing attacks to ransomware and sophisticated hacking techniques. The field of cybersecurity is expanding swiftly, making it somewhat challenging to stay up to date with all the newest advancements and approaches. Recognizing this challenge,

5. The CIO World brings an edition titled “The Most Influential CISOs of the Year 2024,” showcasing leaders in cybersecurity who have proven to be exceptionally skilled at addressing the convoluted and perpetually shifting discipline of cybersecurity. These leaders act as role models, exhibiting not just their technological proficiency but also their strategic vision for protecting companies from cyberattacks. CIO Have a good read ahead! - Alaya Brown Managing Editor

6. C O V E R S T O R Y Engr. Harrison Nnaji Ph.D. Charting the Course for Cybersecurity Excellence

7. James Tewes Transforming Businesses for Greater Value Sawan Joshi Guardian of Digital Frontiers Stuart Walsh Guardians of Data Integrity Tariq Al-Shareef Cybersecurity Visionary and Global Contributor: Safeguarding Saudi Arabia’s Cyber Frontlines Metrics Every CISO Should Track Measuring Cybersecurity Effectiveness The Human Factor Addressing Insider Threats in Cybersecurity for CISOs

8. The Most Influen?al CISOs of the Year 2024 Empowering Organizations with Strategic Vision and Unyielding Security! n the dynamic landscape of today’s digital age, safeguarding sensitive information and digital assets I has remained a paramount concern. The escalation of cyber threats necessitates visionary leaders who possess a deep understanding of cybersecurity intricacies along with the strategic foresight to pave the way for excellence. Meet Dr. Engr. Harrison Nnaji, a distinguished professional with an impressive array of qualifications, including four Masters degrees, a Ph.D., and an extensive list of certifications: CCISO, CISM, CEH, CCNP, CCSP, CISSP, MoR, and TOGAF9. With over 17 years of experience, he has earned a reputation as a trailblazer in the fields of cyber, data, and information security. His journey has been marked by consistent successes in steering organizations towards resilient security measures while optimizing resources for maximum impact. Harrison isn’t just known for his cybersecurity expertise; he's a prominent figure who generously shares his wealth of knowledge without reservation, particularly in areas such as:

9. Dr. Harrison Nnaji Group Chief Informa?on Security Officer FirstBank of Nigeria Ltd. & its Subsidiaries

10. Leadership: Harrison's leadership skills are evident in his year-over-year improvements in key metrics. His pursuit of ability to guide teams and foster unity, not just in securing excellence remains unwavering, ensuring that loyalty, systems but in bringing diverse groups together towards productivity, and profitability are constant companions on achieving common goals. his journey. These achievements have earned Harrison Motivation: His commitment to excellence, evident in his Nnaji the title of “The Most Influential CISO of the Year pursuit of continuous professional development, serves as 2024,” an award bestowed by The CIO World, a motivation for those around him. He also regularly shares prestigious global magazine dedicated to sharing the motivational nuggets across different channels to keep his inspiring and transformative stories of professionals and followership engaged, coached, and guided. leading businesses worldwide. Career Success: With a track record of transforming challenges into opportunities, Harrison has consistently Below are the highlights of the interview: delivered year-over-year improvements in key metrics, cementing his role as a transformational force. Unleashing Strategic Vision: Harrison Nnaji's Impact Entrepreneurship: His strategic acumen goes beyond on Today's Security, Tomorrow's Possibilities traditional roles, as he has demonstrated an entrepreneurial spirit in his ability to engineer, design, and deliver security Harrison Nnaji is an accomplished Data and Information solutions that transcend industry boundaries. Security Strategist & Practitioner with 17+ years of solid experience in the conception, engineering, design, delivery, Harrison Nnaji is the Group Chief Information Security operation, and optimization of cyber, data, and information Officer (CISO) at FirstBank Nigeria Ltd. and Its security, risk management, networking, IT operations, and Subsidiaries, where his influence extends far beyond his project management. formal title. Holding a degree in Electrical and Electronics Engineering, a Master’s in Project Management, M.Phil. in He has achieved repeated successes in leading Management, an M.Sc. in Security Management, and cybersecurity strategies and secure computing practices another M.Sc. in Cyber Security majoring in Cloud with both emerging and established technologies/processes, Security, he possesses a formidable skill set, knowledge, surpassing maximum operational impacts with minimum and experience. His unwavering commitment to ethical resource expenditures across diverse industries, including standards and integrity are evident in every facet of his Banking, Telecommunications, Distribution, Original work. Equipment Manufacturers (OEMs), and Service Integration. Harrison’s legacy is built on his ability to seamlessly engineer, design, and deliver security solutions that His proficiency extends to areas such as internetworking, transcend industry boundaries. His expertise in contract management, IT governance and processes, IT internetworking, IT governance, infrastructure portfolio management, infrastructure architectures, and IT architectures, people management, emerging technologies, delivery management. Harrison possesses strong diplomatic strategy formulation and execution, and IT delivery skills, a natural affinity for cultivating relationships, and a management has been instrumental in fostering holistic talent for persuading, facilitating, and building consensus improvements in the cyber security landscapes. among diverse individuals, all with an undiluted focus on prime objectives. A diplomatic virtuoso, Harrison's natural affinity for building relationships, persuading stakeholders, and Thriving in a fast-paced, multicultural, multilingual, and fostering consensus sets him apart as a leader who not only multifaceted arena, Harrison embraces challenges as secures systems but unites teams. His journey thrives in a opportunities for continual professional growth. He is fast-paced, multicultural, and multilingual arena, where currently completing another Ph.D. in Offensive Cyber challenges fuel his growth, and his dedication to continual Engineering to deepen his knowledge of the continuous professional development is palpable in every endeavor. changes in the cyber threat landscape and the impact of the emerging technologies. Harrison's diverse capabilities Under his leadership, working with all stakeholders to translate to immediate value while upholding prevailing harmonize emerging technologies and secure computing ethics and standards for integrity, dedication, teamwork, practices have been nothing short of exemplary. His ability productivity, profitability, and excellence. to turn challenges into opportunities has led to remarkable

11. Visionary: From Engineering to Cybersecurity Leadership Prior to his academic pursuits, Harrison embarked on a career in Nigeria, fulfilling his national youth service requirements. He gained valuable experience working for Telnet, a premier IT systems organization in the country, where he served as an IT Support Engineer. This role fueled his passion for information technology and allowed him to witness various IT interactions, interventions, and troubleshooting processes. Taking advantage of this opportunity, Harrison began to develop his skills in IT alongside his engineering background. He obtained the Cisco Certified Network Associate certification even before his graduation from the national youth service program. Impressed by his performance, Telnet Nigeria Ltd. decided to retain his services as a Network Support Engineer, and he continued working for the company after completing his national youth service. Within Telnet, Harrison expanded his knowledge in information technology, focusing on networking and network technologies at a subsidiary called iTECO. He thereafter joined a new company, Reddington Nigeria Ltd, A VAD (Value Added Distributor) as the Cisco Pre-sales Engineer. This opportunity exposed him to sales, marketing, contract closure, partner management, and contract management, which significantly enhanced his customer engagement, people management skills and business acumen. During his time with Reddington Nigeria, where he worked on various projects and prospects, Harrison received another career opportunity to join Airtel Nigeria Ltd. a telecommunication company as an IT Security Specialist, shifting his focus from networking to security. This role exposed him to the Airtel Group’s practices and further expanded his experience in the telecommunications industry. He began working for IBM in 2011 as a manager of infrastructure and network security. He took on responsibility for networking and security components while supporting multiple projects at IBM. Driven by his will to improve his abilities, experiences, and knowledge as well as his willingness to take on new responsibilities for more value creation, Harrison's career kept developing.

12. This drive led him to pursue a Master’s Degree in Project customers with minimal exposure to risks. Records show Management, enabling him to contribute more effectively to that necessary steps are being taken to safeguard the major regional projects at IBM. customers and maintain their satisfaction. In pursuit of his passion for organizational transformation Harrison's Guide to Navigating Cyber Risks and digitalization, Harrison seized an opportunity to join UBA Plc – a major Pan African Bank, as the pioneer Head In the world of managing cyber risks, Harrison is a leading of their Enterprise Security Division. During his tenure, he expert. He wants us to know that dealing with cyber risks is focused on building security standards and architecture and an ongoing journey, not a one-time project. He knows a lot implementing measures to mitigate cyber-attacks and fraud. about this topic and makes it easy to understand. His expertise in technology management, practices, and regulations played a crucial role in driving UBA’s digital Harrison says that cyber risks are not just about a and cyber defense transformation. company’s reputation. They are about protecting important assets, adopting enriching practices, and stopping threats As his career progressed, Harrison continued to acquire effectively defending against cyber threats. To make a good knowledge, experiences, and skills to stay ahead. He plan for cyber risks, he says you need to know what your pursued additional master’s degrees, this time focusing on business is about. This will improve the chances of finding security, management and cloud technologies. Recognizing and protecting important assets like systems, people, the potential of cloud adoption, he delved into cloud contracts, ideas, and partnerships. Harrison also talks about security and cloud technology to ensure well-informed how even if you use products and services without knowing decision-making. who made them, you still need to keep them safe by applying your personal cyber hygiene practices, he doesn’t Driven by a desire to remain a transformational leader, he only talk about cyber risks. He also talks about other pursued a Ph.D. in Management, Leadership, and problems like fraud and weak systems. Organizational Strategy at Walden University. This advanced degree equipped him with the necessary tools to When something goes wrong, he has ideas on how to fix it. drive organizational transformation and maximize He talks about using a technique called heat mapping to opportunities for value creation at scale. understand the state of the ecosystem, categorize the issues, and understand what to fix first. He also wants Transforming Individuals and Organizations companies to plan for the short, medium, and long-term to keep getting better. Harrison says we shouldn't ignore old Many challenges have been encountered and addressed in problems when we face new ones. Every vulnerability college, leading to personal transformation for numerous should be tracked until closure is validated. individuals. Harrison has played a role in transforming those who work with him. Additionally, he has spoken at Most importantly, he wants us to know that dealing with various regional, local, and global conferences, even cyber risks is always changing and challenging. We need to participating in major conferences as a speaker, panelist, or pay attention and be ready to protect our businesses moderator. consistently and continuously. However, the focus remains on acquiring sufficient relevant Understanding Business and Cybersecurity knowledge and understanding of the terrain and potential threats to effectively mitigate cyber risks and related threats Harrison knows a lot about how business and cybersecurity while maximally promoting and protecting the business work together. He says each business is different, so their aspirations. In terms of cybersecurity and its associated cybersecurity plans and practices should be too. concerns, Harrison offers unique selling propositions, precautionary measures, and comprehensive systems to Harrison talks about different ways businesses work, like ensure the protection of both customers and clients. people working from home, on their phones, or pursuing Harrison championed the development of intricate systems, different business aspirations. He says we need to hire the architectures, and strategies to continue serving all right people, and be careful—that we should have good practices and follow them.

13. Technology is a big part of cybersecurity, and he knows it. Harrison’s top advice involves thorough planning and He wants us to protect things like computers, networks, and continuous learning. He’s adept at setting ambitious data centers. We need to be careful with data and control objectives and gleaning insights from them. His aspiration who can access them. is for people to be well-prepared for fresh opportunities and the challenges they bring. Training is important. People need to know what to do to stay safe. And when something bad happens, we need a Great Advice from Harrison plan to fix it. We also need to talk to the public if something goes wrong. Hiring other companies to help when Harrison frequently gets asked about becoming a Chief necessary is advisable, but we need to make sure they fit Information Security Officer (CISO). He stresses the our business and keep control in-house, says Harrison. significance of acquiring the right skills and being open to continuous learning. Making a Big Impact According to him, it’s essential not to solely focus on the Harrison has proven himself to be a valuable asset to both job title. Instead, he recommends gaining a strong grasp of individuals and businesses, bringing a lot of practical cybersecurity, especially in the realm of infotech. This benefits. broader knowledge equips individuals to handle various tasks, not just one. Harrison advises creating a skill His impact is evident in various aspects of life. Moreover, checklist and working on acquiring those skills. This through his extensive LinkedIn network, he generously approach enhances capabilities and the overall job shares his valuable knowledge with the community, performance. engaging in events and collaborations. His involvement in cybersecurity rule-making groups highlight his commitment In addition, he discusses the benefits of setting up a to the industry’s growth. personal home lab. He sees this not only as a practical endeavor but also as a means of continuous learning. He Harrison earned the title of “CISO of the Year” in a certain believes that ongoing education is crucial for personal region of Africa, a fact he keeps humble and private. His improvement and knowledge enrichment. His concepts intelligence shines through in real-life scenarios, such as carry substantial value and extend aid to numerous thwarting cyber-attacks originating from different countries. individuals and businesses. His actions are driven by importance rather than awards, underscoring his genuine nature. Dedicated Pursuit of Personal and Professional Excellence: A Glimpse of Harrison's Achievements Throughout his journey of personal and career growth, Harrison has dedicated himself to a diverse range of courses that have enriched his knowledge and skill set. These courses span across various domains, each contributing to his expertise and commitment to continuous improvement: 1. Accounting & Finance 2. Business Economics 3. Computer Application/ Information Technology 4. Contract Law 5. Cost Management 6. Design Management 7. Development Economics 8. Effective Presentation and Communication Skills 9. Human & Industrial Relations 10. Industrial & Labour Law 11. Nature & Content of Project Management 12. Negotiation

14. Hiring the right individuals and conducting thorough background checks are crucial cybersecurity measures. Insider risks pose a considerable threat, and organizations must be cautious about who they bring into their teams.

15. 13. Organisational Behaviour exceptional project management skills were 14. Procurement Methods instrumental in the project’s success. He not only 15. Quantitative Methods & Simulations Studies troubleshooted effectively but also sought continuous 16. Resource Management improvement, demonstrating his commitment to excellence. 17. Research Methodology and Project Report Harrison's well-rounded professionalism makes him an 18. Time Management asset to any organization.” These comprehensive courses not only showcase Harrison’s Uchechukwu Ngonebu - Project Director at Huawei: commitment to learning but also his determination to excel “Having worked with Harrison, I can confidently say he’s a in various facets of the ever-evolving fields of technology, highly detailed professional, particularly in Network & IT management, and cybersecurity. Security Management. His deep knowledge of inter- network platforms is a significant asset to any company Honors and Awards – Harrison’s drive for excellence he collaborates with.” hasn't gone unnoticed, as he has received multiple honors and awards for his contributions and achievements: Fred Ekete - Lead, Quality Assurance and Tools at Airtel Nigeria: • 9 Commendation Letters for Various Exceptional “Throughout my interactions with Harrison over the past 7 Contributions Towards the achievement of the years, I have found him to be transparent, diligent, and Bank’s Business Aspirations Issued by UBA PLC. honest, and his integrity is commendable. I wouldn't • IBM Manager’s Choice Award Issued by IBM · Dec hesitate to recommend him to any organization that values 2013 these qualities.” • Award for Excellent Service Delivery Issued by Hamid Husain: Chief Information Officer, ZAIN Sunny Birdi - Entrepreneur: Nigeria. Jan 2009 · Jan 2009 “Harrison's dedication during the IBM/Airtel • Award for Excellent Service Delivery Issued by partnership was exceptional. He demonstrated a multi- John Ayo: Chief Information Officer, Celtel Nigeria skilled and forward-thinking approach, effectively Ltd. Mar 2008 · Mar 2008 managing both internal and external stakeholders. His • CISO of the year award - Finnovex West Africa business acumen and leadership skills are highly Awards, 2022 commendable. Harrison is undoubtedly a 5-star player, and • FirstBank Hero Award - FirstBank Annual Merit I wholeheartedly recommend him.” Awards, FAMA 2020, 2022 These accolades reflect not only his dedication but also his tangible impact on the organizations he has been a part of. Harrison's journey is characterized by a relentless pursuit of knowledge, an unwavering commitment to excellence, and a profound impact on the organizations he has served. His achievements, both in terms of educational pursuits and professional recognition, stand as a testament to his passion and determination in the fields of technology, cybersecurity, and management. There are many more highlights on Harrison Nnaji’s LinkedIn profile. Testimonials from Professionals who have worked with Engr. Harrison Nnaji, Ph.D. Jacxine Fernandez - VP of Information Security at Bangalore International Airport Ltd.: “I had the privilege of working closely with Harrison during the West Africa IT LAN Zoning project for Airtel. Harrison’s attention to detail, technical expertise, and

18. The Most Influen?al CISOs of the Year 2024 Embracing the Joy of Turning Around Struggling Ventures and Constantly Striving for Improvement! hink about a time when you faced a formidable challenge. Did you not emerge from that experience T stronger, wiser, and more resilient? Challenges have an incredible capacity to foster personal growth. They compel us to delve into our inner resources, tap into our creativity, and discover strengths we might not have known existed. "Can a business truly thrive without facing and overcoming challenges? Is there joy in smooth sailing, or is it in the storm that we discover our true capabilities?" and methodical, and goes beyond the ordinary. "I have These are the questions that resonate with James Tewes, a never been someone who was happy simply to do what was seasoned professional whose passion lies not in the comfort needed and no more. I would always look for ways to of well-established enterprises but in the thrill of turning the improve both myself and the project or environment that I tides for struggling businesses. am working on," he notes. As the Chief Information Security Officer at Greengage, Constantly refreshing his skills and delving deep into the he embodies the spirit of transformation. He shares, "I often products he works with, James exemplifies a commitment honestly have found enjoyment in all the sectors that I have to excellence and a relentless pursuit of improvement. His worked in, but it must involve a challenge. Coming into a journey at Greengage is not just about securing information; business that is already working and functioning well does it's about fortifying businesses, navigating challenges, and not interest me." For him, the allure lies in the prospect of turning adversity into triumph. In the world of business revitalizing a struggling enterprise, whether it's addressing alchemy, he is the maestro orchestrating the transformation aging infrastructure, modernizing security measures after an of challenges into opportunities. audit reveals vulnerabilities, or even building a business from the ground up. Below are the interview highlights: The heart of James's professional satisfaction lies in the Could you please elaborate on Greengage and its process of turning a business around and adding substantial inception story? value. "What makes me happy and gives me the reason to get up and work is when I can turn a business around and Greengage is a digital finance pioneer that provides a add considerable value," he emphasizes. platform of relationship-based e-money account services to SMEs, high-net-worth individuals, and digital asset firms to Never content with merely meeting the requirements, he is the highest ethical, secure, and compliance standards. known for seeking opportunities to enhance both himself Alongside our account services, we provide clients access and the projects he undertakes. His approach is structured, 16 January, 2024 www.thecioworld.com

19. James Tewes Chief Informa?on Security Officer Greengage 17 January, 2024 www.thecioworld.com

20. Can you summarize your 28 years of experience in infrastructure and cybersecurity, emphasizing key achievements? Throughout my career, which began at the age of 17, I've had the privilege of working for esteemed companies and collaborating with exceptional colleagues on exciting and challenging projects. Notably, a few milestones include: London 2012 Olympics and Paralympics: Working on this project was a unique privilege. The high visibility and pressure during this global event required quick learning and problem-solving. I identified and resolved environmental issues promptly, ensuring a smooth operation of the infrastructure during the live games, which had a global viewership exceeding 3 billion. The project involved managing over 10,000 servers and workstations and 8,000 users, spanning static core infrastructure and dynamic event locations. Teams worked around the clock, addressing critical changes and fixes during the live games and executing planned changes at night to prepare for the following day's events. British Petroleum (BP): At BP, a significant achievement was contributing to the data center consolidation project. This involved building primary and secondary data centers in London and decommissioning all European data centers. to a B2B lending platform offering digital sources of My role in building the initial core server infrastructure money. Our tailored services are delivered by people, facilitated the migration of approximately 40,000 servers, empowered by technology. significantly reducing the physical server footprint through virtualization. Greengage was founded in 2018, and we now have over 30 staff and excellent client feedback. We embrace new Harrods Bank: Initially hired as a consultant for technology in digital assets and our core proposition as a infrastructure refresh, I played a crucial role in means to add value to our clients in their day-to-day understanding and migrating legacy systems. Working in endeavors. the complex environment of the banking sector, I contributed to scaling up the bank's staff and systems, Through Founder’s Eyes: witnessing a 400% increase in size. My focus on security remained paramount throughout, ensuring a seamless Sean Kiernan is the Founder and CEO of Greengage, and migration and ultimately leading to the bank's sale to a they set up the firm with a view to building a service-led challenger bank. organization to support our clients in navigating the bridge between traditional financial services and digital Sonali Bank: After joining as a security consultant, I innovation. Sean has extensive experience in financial addressed gaps highlighted in an external cybersecurity services, having worked in various executive management audit. Implementing the necessary security layers positions. He founded Greengage after working at the first significantly improved the bank's security posture. Taking bank in the world to offer crypto products to clients, Falcon over the IT department, I crafted an 18-month roadmap, Private Bank, where he served as the COO and interim modernizing the infrastructure and leaving the bank in an CEO of the London operation until he left to establish enhanced and secure state. Greengage. Prior to that, he held management positions at Clariden Leu, a division of Credit Suisse, and Zurich In each role, my commitment to learning, problem-solving, Financial Services. Mr. Kiernan has an MBA from the and prioritizing security has been central to achieving University of St. Gallen and a BSc from Georgetown successful outcomes. University. 18 January, 2024 www.thecioworld.com

21. Among the financial, Oil & Gas, Sports, Manufacturing, Working at Sonali Bank UK, I prioritized implementing a and Government sectors, which presented the most comprehensive MDR (Managed Detection and Response) unique challenges, and how did you address them? solution as a vital defense measure. For smaller banks like ours, MDR covers essential components like a 24x7 SOC, In the financial sector, I've experienced challenges that are SIEM, Vulnerability Scanning, Cloud Posture Management, particularly daunting due to the intricate technologies and and Endpoint management. Limited resources often expose customized nature of products. Security measures must be smaller banks to vulnerabilities, making continuous meticulously implemented to protect the environment and monitoring crucial. In the financial sector, risk awareness clients, while strict adherence to regulations is paramount. isn't a 9-5 affair; it demands 24x7 vigilance. Any claim of complete security is unrealistic. As a CISO, honesty about Successfully overcoming these challenges hinges on a potential threats is vital, and taking proactive steps to profound understanding of products, configurations, and safeguard both the bank's and clients' data is paramount. security measures at the granular level. Thorough planning and end-to-end testing, including robust rollback plans, are In your role, collaboration with third-party support and essential. Involving banking teams in testing is critical, as suppliers is crucial. How do you ensure effective relying solely on IT can lead to significant oversights. partnerships and smooth integration with external Testing must cover all possible scenarios, accounting for the entities? varying activities banks conduct hourly, daily, weekly, and monthly. Failure to test comprehensively can result in Effective collaboration hinges on adeptly managing seemingly successful upgrades that reveal issues days or partnerships and workflows, a task contingent on the weeks later. In the financial industry, any failure in involved companies. Employing skilled project managers upgrades or system changes can lead to substantial financial significantly influences workflow and change management. and customer repercussions, causing severe reputational Establishing centralized communication points among damage to the business. Major outages are often attributed companies is pivotal to ensuring prompt and efficient work to inadequate testing and a failure to test rollback execution. Collaborating with proficient, communicative, procedures thoroughly. and adaptive companies enhances the overall experience. Can you share an example of effectively communicating However, encountering less cooperative entities poses a complex technical issue to stakeholders at different challenges, impeding progress in implementations, changes, business levels? and bug fixes. The judicious choice of tracking tools proves vital for monitoring extensive workflows and task statuses In my experience, effective communication within a and preemptively addressing potential issues, facilitating business requires tailoring your message to the audience's collaborative problem-solving and timely resolution. varying levels of understanding. Particularly in IT, where technical proficiency can differ widely, it's crucial to focus Reflecting on your career, what accomplishment or on the business impact, necessary actions for resolution, project are you most proud of, and how did it positively and the implications of inaction. By emphasizing these impact the businesses you worked with? aspects and presenting with confidence, I've noticed increased buy-in from the business. It's essential to avoid I would say my current role as CISO of Greengage is one of overly technical discussions, as executives may disengage, my proudest. While I have enjoyed many projects at various leading to resistance against proposed changes. companies, at Greengage we were in the fortunate position of building a financial institution environment from the For instance, in a scenario involving a financial institution, I ground up. This is a great challenge: having the ability to needed to upgrade and replace key payment gateways to design the most optimal architecture using the most enhance resilience. Despite initial doubts from my direct appropriate products for all infrastructure and security management about securing funding, I successfully layers, rather than what often happens traditionally: engaged with the bank's leadership. I provided a high-level inheriting the chosen products by historic teams, which may rationale for the work, offering a straightforward technical not be the right products for their purpose. overview that resonated with all levels of understanding. This approach proved successful in obtaining the required This enabled the business to successfully go live with its e- funding and steering the project to completion. money offering and start onboarding its customers, which was a proud moment for the business and proves what can Can you highlight a successful implementation of a be achieved with the hard work of all the teams. cybersecurity solution that significantly improved an organization's security posture? 19 January, 2024 www.thecioworld.com

22. Metrics Every CISO Should Track Measuring Cybersecurity Effectiveness he only truly secure system is one that is powered Key Metrics for Measuring Cybersecurity Effectiveness off, cast in a block of concrete, and sealed in a lead- T lined room with armed guards. In the ever-evolving Incident Detection Time: landscape of cybersecurity, where threats loom large and technology advances at a rapid pace, the quote by Gene • Metric: Mean Time to Detect (MTTD) Spafford resonates with a certain irony. Achieving absolute • Significance: MTTD measures the average time it takes security is an elusive goal, but that doesn't mean to identify a security incident from the moment it cybersecurity efforts are in vain. Instead, it underscores the occurs. A lower MTTD suggests a more efficient importance of measuring cybersecurity effectiveness to detection process, enabling quicker responses to enhance resilience and response. How do we evaluate the potential threats. efficacy of our cybersecurity measures? What metrics provide meaningful insights into our defenses? Incident Response Time: In this article, we delve into the crucial realm of measuring • Metric: Mean Time to Respond (MTTR) cybersecurity effectiveness, aiming to navigate the • Significance: MTTR measures the average time taken complexities of securing our digital landscapes. to respond to and mitigate a security incident once detected. A swift response is crucial for minimizing the Understanding Cybersecurity Effectiveness impact of a breach and preventing further damage. At the heart of any robust cybersecurity strategy is the False Positive Rate: fundamental question: How effective are our security measures? Cyber threats are dynamic and multifaceted, • Metric: Percentage of False Positives ranging from sophisticated malware and phishing attacks to • Significance: While detection is essential, too many zero-day vulnerabilities. In this environment, a proactive false positives can overwhelm security teams and lead and adaptable approach is necessary, and that's where to alert fatigue. A lower false-positive rate indicates measuring cybersecurity effectiveness becomes imperative. more accurate threat detection, allowing teams to focus on genuine risks. Effectiveness in cybersecurity is not a one-size-fits-all concept. It encompasses various dimensions, including Vulnerability Patching Time: prevention, detection, response, and recovery. The goal is not only to prevent breaches but also to minimize the • Metric: Time to Patch Vulnerabilities impact when preventive measures fall short. It involves • Significance: Timely patching of vulnerabilities is creating a layered defense strategy that combines critical to closing potential entry points for attackers. technology, policies, and user awareness. Monitoring and reducing the time it takes to patch known vulnerabilities enhances the overall cybersecurity posture. 20 January, 2024 www.thecioworld.com

23. 21 January, 2024 www.thecioworld.com

24. Phishing Resilience: • Risk-Based Metrics: Develop metrics that align with the organization's risk appetite. Focus on measuring the • Metric: Phishing Click Rate effectiveness of controls that directly mitigate high- • Significance: Phishing attacks remain a common entry impact risks. point for cybercriminals. Measuring the rate at which users click on phishing links provides insights into the • Continuous Monitoring: Implement continuous effectiveness of awareness training and the overall monitoring systems to track real-time security metrics. security culture. This allows for immediate responses to emerging threats and provides a more accurate reflection of the User Education Effectiveness: current security posture. • Metric: Training Completion Rates • Red Team Exercises: Conduct regular red team • Significance: Educating users on cybersecurity best exercises to simulate real-world attack scenarios. These practices is essential. Monitoring training completion exercises help evaluate the effectiveness of both rates helps gauge the effectiveness of educational preventive and responsive measures in a controlled programs and identifies areas for improvement. environment. Endpoint Protection: • Collaborative Threat Intelligence: Engage in information sharing and collaborative threat • Metric: Endpoint Detection and Response (EDR) intelligence efforts with industry peers. This collective Effectiveness approach enhances the ability to identify and respond • Significance: Endpoints are frequent targets for attacks. to emerging threats more effectively. Evaluating the effectiveness of EDR solutions in detecting and responding to threats at the endpoint • Security Awareness and Training: Emphasize the provides a crucial layer of security. human element by investing in ongoing security awareness and training programs. Measure the impact Challenges in Measuring Cybersecurity Effectiveness of these programs on user behavior and the overall security culture within the organization. Despite the importance of these metrics, measuring cybersecurity effectiveness comes with its own set of Conclusion challenges. The dynamic nature of cyber threats, the evolving technology landscape, and the increasing Metrics are valuable indicators, but they should not be the sophistication of attackers make it challenging to establish sole focus. Cybersecurity effectiveness is a holistic concept static benchmarks. Additionally, the interconnectedness of that involves people, processes, and technology working in systems and the sheer volume of data generated pose tandem. While metrics provide quantifiable insights, difficulties in discerning meaningful patterns. qualitative assessments, adaptive strategies, and a commitment to continuous improvement are equally Moreover, the intangible nature of successful cyber essential. attacks—particularly those prevented—complicates the assessment process. How can one measure the absence of a As Gene Spafford's quote suggests, achieving absolute breach? It requires a shift in mindset from merely counting security might be an unattainable goal, but the journey successful attacks to evaluating the effectiveness of toward it is marked by resilience, adaptability, and a proactive measures in thwarting potential threats. commitment to staying one step ahead of the ever-evolving threat landscape. In measuring cybersecurity effectiveness, A Comprehensive Approach to Cybersecurity organizations not only safeguard their digital assets but also Effectiveness fortify their ability to thrive in an interconnected and unpredictable cyberspace. To address these challenges, organizations must adopt a comprehensive approach to measuring cybersecurity - Alaya Brown effectiveness. This involves integrating quantitative metrics with qualitative assessments, leveraging technology, and fostering a culture of continuous improvement. 22 January, 2024 www.thecioworld.com

26. The Most Influen?al CISOs of the Year 2024 Championing Privacy, Inspiring Change, and Nurturing the Future! n a world dominated by Gen Z, where our lives are increasingly lived online, from social media I interactions to online purchases, each digital engagement contributes to what has come to be known as our "digital footprint." This footprint is essentially a trail of personal data points that collectively paint a vivid picture of who we are, what we like, and how we direct the digital landscape. While this information can be harnessed for targeted advertising or improved user experiences, it also raises concerns about the extent to which individuals have control over their own data. data; it's about empowering individuals to take well- Sawan Joshi emerges as a stalwart defender, donning the informed actions in their roles as guardians of digital mantle of Chief Information Security Officer at Mitiga sanctuaries. Solutions & The Privacy Business Group Ltd. Behind the title of Chief Information Security Officer lies Sawan's journey into information security was not just a the role that truly defines Sawan—being a father. As a career choice; it was a calling fueled by a profound sense of parent to quadruplet children, he draws inspiration from responsibility. Inspired by the digitization of data, he their innocence and envisions a future where digital recognized the transformative power of technology in landscapes are resilient and secure. For him, the shaping our lives. Simultaneously, he was drawn into the responsibility of protecting not just his own family but the industry by the alarming surge in cybercrimes, each one a global digital community adds depth and urgency to his stark reminder of the vulnerabilities of our interconnected mission. world. Sawan Joshi is not just safeguarding the present; he's Given a stage to speak about protecting people, Sawan's architecting a resilient future. His role extends beyond the message is clear and concise. In a world where data is both corporate corridors to the heart of family life. By instilling the lifeblood of progress and the target of malicious intent, the importance of privacy and security in his children, he's he advocates for a collective responsibility to safeguard shaping a generation that understands the value of digital privacy. As the CISO, his mission extends beyond securing trust and the significance of safeguarding data. 24 January, 2024 www.thecioworld.com

27. In an age where information is power, Sawan's advocacy for privacy and security becomes not just a professional responsibility but a profound commitment to the well-being of individuals and generations to come. Below are the interview highlights: Could you please brief us about Mitiga Solutions and its inception story? Founded in 2018, Mitiga Solutions is a science-based climate risk intelligence company that helps organizations understand their exposure to climate risk to make well- informed decisions and protect their assets. Can you share your journey in the fields of information security, IT operations, and data protection, highlighting key milestones in your 15-year career? Over the past 15 years, we have seen many acquisitions, mergers, and even divestitures, and my career has been loaded with this topic. With over 10 acquisitions under my belt, I supported my employers with complex scenarios where global offices are in scope and provided solutions from technological capabilities that have come from highly available private and public clouds and the way replication solutions can allow for data integrity and collaboration. It was important to provide agile and adaptive solutions during these initiatives. Some key highlights during my career were building information security and operations for London Luton Airport, a highly regulated essential services provider that needed a balanced blend of internal and external security that not only protected digital systems but also provided monetization opportunities through physical security technologies inside the airport facilities. Over the years, I leveraged the opportunity to network at the board level. This level of communication was a very exciting area for me, as it built my own career confidence through the validation it received. I would always bring well-prepared information to a meeting to validate having a place at such meetings, and it was important that I knew it so well that I could articulate it in that meeting to keep Sawan Joshi stakeholder interest. This always meant keeping the focus Chief Informa?on Security on why my points mattered in the first place. Officer During my role at First Port Ltd., which is the UK's largest Mi?ga Solu?ons & The property management company and now a global Privacy Business Group Ltd. organization that has set out to grow by acquisition at a rapid pace, protecting the executive leadership team's interests was vital, as was ensuring impartial facts reached 25 January, 2024 www.thecioworld.com

28. and continued to top up my knowledge, which is constantly part of the territory, I was able to tailor and adapt it to any organization type once I understood the business and what applied to them first. This has become my personal repeatable strategy, which has now been applied to an airport, a global sports retail company, the UK's number one charity for dogs, multiple financial services companies, and now 2 climate tech companies. These have become adventures I love to tell my network and specifically my children as they grow up and begin to understand that working for who you want is going to have a better chance of happening if you empower yourself with a career strengthened by knowledge, and if you know it well, you can explain it well. In your current role as the Chief Information Security Officer at Mitiga Solutions, what strategic initiatives have you implemented to enhance information security within the organization? The time to act against the risks our world faces from climate change is now; it cannot be an afterthought, and within the public and private sectors, we have an opportunity to take steps that make an impact now. It all starts with taking a 360-degree look at all prospects and what matters to them. This means customers, partners, and investors now and in the future. Building a strategic roadmap along with laws and regulations that are within scope and will build trust in the supply chain is essential. I articulate a roadmap like this as protection around people, platforms, and processes that can provide balanced protection of assets and support revenue generation through independent validations. These are how we make sure we can be relied on to score highly in trust scores with our the board. To do that, strategic alignment was key, and to privacy-by-default design business architecture. ensure that as we completed these acquisitions, the risks that were taken on by the acquired company were going to In these pillars, what that would look like is to ensure we be managed with trusted eyes and that clear sight of what put a layered defense around people to ensure we protect they were was shared before closing the investment. their identity with multiple factors, plus the additional layers that include anomaly detection for those sign-ins, To do that, I created a repeatable acquisition capability that such as impossible travel metrics and user behavior could be applied each time, which led to success in my role, analytics to detect deviations from normal interactions and and new risks were processed into the security roadmap. data manipulations. To do that, ensuring technologies that can scale with Additionally, on platforms, it is vital to implement a clear, simplicity was vital, as was having the internal and external transparent view of all these activities once an identity has people on board to make it happen. I have often found that been validated to ensure trust, but verification is constant it is not the size of the team but the capability of the team and any adverse interactions and activities across platforms that counts most. are quickly identified so we can take response actions. To sum up, some highlights of my data protection experience are not sector-specific. As I grew my experience 26 January, 2024 www.thecioworld.com

29. The third pillar is to build robust capabilities around processes through top-down governance and ensure we have data protection compliance and business continuity, with disaster recovery baked right in. That is how you become breach-ready so that an adverse incident becomes an operational metric to track and continuously improve on and not a business-hindering aftermath. results measured quarterly, and I want to bring the capability to help organizations have a low-level touch from This does not mean going out and purchasing all the latest an advisory and to easily gain access to software that is not security technologies that cover the acronyms that are only low-cost but will give a 3-step plan to risk and constantly evolving as buzzwords in the broad offerings of sustainability frameworks that will help them mind their many solution providers, but this means ensuring financial own posture. That is why I founded TriStep.io, which is a stewardship is at the heart of a roadmap like this and that risk and sustainability framework platform that will be investments are of low complexity and cost, thus achieving available for everyone in January 2024. understandable security by design. As a business leader, that is important. Could you share insights into the significance of the certifications you obtained? At The Privacy Business Group Ltd., how did you contribute to the development of privacy strategies? These qualifications offer very relevant future-proof value What were the key challenges you faced in this role, and and offer a complex path to obtain them, which is part of what is TriStep.io? the achievement after all, the easy options are never of the most value. As I found my approach to applying privacy and security strategies to any sector successful, I realized I wanted to The qualifications from IAPP, ISC2, and ISACA offer apply this to more companies and reflected on my continuous professional development systems to keep the experience with large enterprises vs. the challenges startups certification valid for a fee, and participation keeps face as they try to do business with large enterprises. I continuous learning on track and your initial investment in wanted to take my experience from both sides into making place. those public and private business partnerships simpler to put together, trustable by validation, and successful in their It is important to know the operating cost of achieving and ability to last. maintaining certifications when deciding how much to work for in salary or self-employment and to take that into That is when I decided to form The Privacy Business Group account when running your own career. My view is that no Ltd., but my goal was not to focus on traditional advisory employer should run your career; it is important to drive services. Today, not many organizations want a 5-year plan that yourself. sold to them in an interview; they want objectives and key 27 January, 2024 www.thecioworld.com

30. Addressing Insider Threats inCybersecurity for CISOs The greatest danger to our cybersecurity often lurks within organization if they don't understand the value of the our own walls. How can CISOs effectively address insider information they're protecting? Creating a culture of threats and safeguard their organizations? cybersecurity awareness starts with education. Regular training sessions and workshops should be conducted to ybersecurity has become a cornerstone in keep employees informed about the latest cybersecurity protecting organizations from an ever-expanding threats, including the potential impact of insider threats. C array of threats. While external threats like hackers This education should extend beyond the IT department to and malware often grab the headlines, the significance of reach all levels of the organization. When everyone insider threats cannot be overstated. Insiders, whether understands the risks, they are more likely to actively intentionally malicious or unwittingly negligent, pose a contribute to the organization's cybersecurity efforts. substantial risk to an organization's sensitive data and digital infrastructure. For Chief Information Security Additionally, implementing strong access controls and Officers (CISOs), the challenge lies in navigating this monitoring mechanisms is essential. Limiting access to complex landscape to secure their organizations from sensitive information on a need-to-know basis reduces the within. likelihood of unauthorized or unintentional data exposure. Regularly reviewing and updating access permissions, Understanding Insider Threats especially when employees change roles or leave the organization, is crucial to maintaining a secure Insider threats can manifest in various forms, from environment. employees with malicious intent seeking financial gain or revenge to well-meaning staff who inadvertently Implementing User Behavior Analytics compromise security through negligence. In fact, a 2021 Insider Threat Report found that 68% of organizations feel It's not just about what people do, but how they do it. vulnerable to insider attacks. This underscores the urgency Understanding user behavior is key to detecting potential for CISOs to adopt a comprehensive approach to address insider threats before they escalate. this multifaceted challenge. User Behavior Analytics (UBA) plays a pivotal role in The first step in tackling insider threats is acknowledging identifying anomalous activities that may indicate insider that they exist. No organization is immune, regardless of its threats. By establishing a baseline of normal user behavior, size or industry. As a CISO, it's imperative to cultivate a security systems can detect deviations that may signal a culture of cybersecurity awareness within the organization potential security risk. For example, sudden access to and foster an environment where employees understand the sensitive data by an employee who has never accessed it potential risks associated with their actions. before or irregular login times can trigger alerts for further investigation. Building a Culture of Cybersecurity Awareness How can you expect your employees to safeguard your 28 January, 2024 www.thecioworld.com

31. The Human Factor 29 January, 2024 www.thecioworld.com

32. CISOs should leverage advanced technologies, such as well-defined incident response plan is essential when machine learning algorithms, to enhance the accuracy of addressing insider threats. UBA. These technologies can analyze vast amounts of data and detect patterns that may elude traditional security No cybersecurity strategy is foolproof, and insider threats measures. Investing in UBA not only strengthens an may still occur despite the best preventive measures. CISOs organization's defenses but also allows for more proactive must have a well-defined incident response plan in place to threat mitigation. mitigate the impact of a potential breach swiftly. Monitoring Privileged Users The incident response plan should outline clear procedures for identifying, containing, and eradicating insider threats. With great power comes great responsibility, and privileged This includes collaboration with the legal and HR teams to users are no exception. Monitoring their activities is a handle potential legal and personnel issues. Regularly critical aspect of insider threat prevention. testing and updating the incident response plan ensures its effectiveness when faced with the dynamic nature of insider Privileged users, such as system administrators and threats. executives, have elevated access levels that make them potential targets or unwitting conduits for insider threats. Conclusion CISOs must implement robust monitoring systems to track the activities of privileged users, ensuring that their actions In the realm of cybersecurity, the real challenge often lies align with their roles and responsibilities. not in the complexity of technology but in understanding human behavior. CISOs must address insider threats with a Regular audits and reviews of privileged user access logs combination of technological solutions, cultural initiatives, can reveal any suspicious behavior or unauthorized access. and proactive measures. This proactive approach enables CISOs to intervene promptly and mitigate potential threats before they escalate. As CISOs navigate the ever-evolving landscape of Moreover, it sends a clear message that all users, regardless cybersecurity, addressing insider threats should remain a of their position, are subject to scrutiny to maintain a secure top priority. By building a culture of cybersecurity awareness, implementing advanced technologies like UBA, environment. monitoring privileged users, establishing whistleblower Establishing a Whistleblower Program programs, and having a robust incident response plan, CISOs can strengthen their organizations from within. The Sometimes, the most valuable insights come from within. journey towards a more secure future begins by recognizing Encourage employees to speak up if they notice anything that the greatest threats may be those working within our amiss. own walls, and the key to success lies in a proactive and holistic approach to cybersecurity. A whistleblower program provides employees with a confidential channel to report suspicious activities without - Alaya Brown fear of reprisal. CISOs should work in collaboration with HR and legal teams to establish a robust and anonymous reporting mechanism. This encourages a sense of shared responsibility for cybersecurity and can be an invaluable source of early detection for insider threats. To ensure the effectiveness of the whistleblower program, it's essential to communicate its existence clearly and regularly. Employees should be informed about the importance of reporting any concerns promptly, emphasizing that their contributions play a crucial role in safeguarding the organization. Responding to Insider Threat Incidents Prevention is ideal, but preparation is imperative. Having a 30 January, 2024 www.thecioworld.com

34. A Journey of Compliance, Innovation, and ISO 27001 navigating the complexities of compliance, ensuring that Certification in Healthcare Cybersecurity! the organization not only met regulatory standards but surpassed them. s your data safe? A question echoing through the corridors of the digital age resonates with a sense of Below are the interview highlights: I urgency and responsibility. In a world where information is the lifeblood of industries, it's crucial to have Can you briefly describe your role as the Chief guardians at the helm. Meet Stuart Walsh, the vigilant Information Security Officer (CISO) at Blue Stream guardian of digital fortresses, currently serving as the Chief Academy Ltd. and the primary responsibilities that Information Security Officer (CISO) at Blue Stream come with it? Academy Ltd. As the CISO at Blue Stream Academy Ltd., my role centers Stuart's journey from a website designer to CISO reflects on safeguarding our information systems; my the evolving landscape of cybersecurity. As organizations, responsibilities encompass developing and implementing a especially in sensitive sectors like healthcare, grapple with comprehensive information security strategy that aligns the escalating significance of data, Stuart's story mirrors this with both our business objectives and the stringent paradigm shift. His tenure commenced with expanded regulatory demands of the healthcare industry. A key part of responsibilities in office management, a testament to his my job is managing risks associated with information adaptability and foresight. security, which involves identifying potential threats, assessing vulnerabilities, implementing appropriate With the impending shadow of the General Data Protection mitigation strategies, and ensuring compliance with ever- Regulation (GDPR), Stuart recognized the need to fortify evolving legal and regulatory standards. their defenses and showcase a robust commitment to data protection. The pursuit of ISO 27001 accreditation became I lead the response to any security incidents, collaborate a strategic move, a bold statement affirming Blue Stream closely with various departments to ensure a unified Academy Ltd.'s dedication to safeguarding the integrity of approach to information security, and regularly information. communicate with senior management and stakeholders about our security posture and initiatives. In the pivotal year of 2017, he stepped into the role of CISO, entrusted with the mission to establish and I also oversee the selection and management of security coordinate an Information Security Management System technologies and drive the development of cybersecurity (ISMS). This system not only aligned with GDPR training and awareness programs for all employees. requirements but also laid the groundwork for ISO 27001 certification. His leadership became instrumental in 32 January, 2024 www.thecioworld.com

35. The Most Influen?al CISOs of the Year 2024 Stuart Walsh Chief Informa?on Security Officer Blue Stream Academy Ltd. 33 January, 2024 www.thecioworld.com

36. Understanding the specific needs and challenges of healthcare organizations is crucial when implementing information security policies. Our approach to creating and implementing these policies is a balanced mix of regulatory compliance, risk management, adaptability, collaboration, and education tailored to meet the specific needs of the UK healthcare industry. In terms of regulatory alignment, the UK’s legal landscape for data protection and healthcare information security is guided primarily by the General Data Protection Regulation (GDPR), as incorporated into UK law post-Brexit, and the Data Protection Act 2018. These regulations set the baseline for our information security policies. To align our policies with these regulations, we conduct a thorough analysis of our data processing activities, assessing how data is collected, stored, used, and shared. This helps in identifying and mitigating risks and ensuring compliance with data protection principles. Another key aspect is ensuring that our policies are not static; the healthcare sector and its regulatory environment are dynamic, with evolving challenges and legal requirements. Therefore, our policies are designed to be flexible and adaptable, with regular reviews and updates to In your experience as a CISO, what do you consider the reflect changes in technology, threats, and regulations. most challenging aspect of ensuring information security within a healthcare-focused organization? Collaboration with healthcare organizations, stakeholder engagement, training, and awareness are also integral to our The most challenging aspects of ensuring information policy implementation. security within a healthcare-focused organization are compliance and regulatory requirements. Can you share an example of a significant security challenge you've faced in your role and how you The UK healthcare industry is obviously heavily regulated; successfully mitigated the risk while maintaining ensuring that our organization meets these requirements and operational efficiency? is aware of any changes in the law, the legal landscape, or best practices in data protection, particularly in the post- One of the most significant security challenges I have faced Brexit era, requires regular training and awareness in my role as CISO, especially during the COVID-19 programs for all employees as well as continuous pandemic, was the rapid transition to remote work. This monitoring and auditing of our data processing activities. shift posed a unique set of risks, particularly for our organization, which provides online training and HR The burden of compliance can sometimes be management platforms to healthcare organizations in the disproportionately heavy; as such, it is especially important UK, where data sensitivity and privacy are paramount. that I am able to foresee potential changes and ensure that our organization remains proactive rather than reactive in The primary challenge was ensuring that our employees its compliance efforts and has the agility to adapt to changes could work from home securely without compromising the in a way that aligns with both our legal obligations and confidentiality, integrity, and availability of the sensitive operational realities. data we handle. The risks were multifaceted, including increased vulnerability to cyberattacks, potential data How do you approach creating and implementing breaches, and the challenge of maintaining compliance with information security policies to align with the unique stringent healthcare data protection regulations in a remote needs and regulations of healthcare organizations in the environment. UK? 34 January, 2024 www.thecioworld.com

37. Mitigating these issues required enhanced VPN security, the securing of home networks, increased endpoint protection, improved data access controls, additional training, auditing and monitoring, and adaptation of our business continuity planning. By implementing these measures, we were able to successfully mitigate the risks associated with remote work during the COVID-19 pandemic. Our team remained productive and efficient, and we ensured that the sensitive data we handled remained secure, maintaining the trust of our clients in the healthcare sector. This experience also provided valuable insights and preparedness strategies that have strengthened our overall information security posture. With the constantly evolving landscape of cybersecurity threats, how do you stay informed about the latest trends and technologies to ensure Blue Stream Academy's information security measures remain robust? Staying informed of the rapidly evolving landscape of cybersecurity threats is a critical aspect of my role as CISO. In an industry as sensitive as healthcare, it's imperative that our security measures are not just current but also forward- looking, which involves continuous learning and research, engagement with cybersecurity communities, attending conferences, exhibitions, and workshops, maintaining supplier relationships and industry partnerships, vulnerability assessments, and incident reviews. Considering the sensitivity of healthcare data, how do you ensure compliance with relevant data protection laws, such as GDPR, and maintain a high standard of data privacy? Our approach to compliance with data protection laws and maintaining data privacy involves a blend of ongoing legal Employee training and awareness are key; we regularly understanding, risk management, policy implementation, educate our staff on GDPR requirements, data breach staff training, technical safeguards, vendor compliance, recognition and reporting, and best practices in data incident preparedness, and transparent communication with handling to minimize human error-related breaches. data subjects. A thorough and continuously updated Technical and organizational measures, such as encryption, understanding of GDPR and other relevant regulations is access controls, and regular security audits, are essential; we conduct regular risk assessments and Data implemented and continually revised to safeguard data. Protection Impact Assessments (DPIAs) to identify and Vendor management is also crucial, ensuring that our mitigate potential risks in our data processing activities, partners comply with the same data protection standards aligning with GDPR's proactive risk management through due diligence and contractual agreements. requirements. Finally, transparency with data subjects about their data We have established robust data protection policies and usage, rights, and exercise of these rights is a critical aspect procedures, which are regularly reviewed and updated to of our strategy, ensuring clear communication and ensure compliance with legal requirements. maintaining trust. 35 January, 2024 www.thecioworld.com

38. Cybersecurity Visionary and Global Contributor: Safeguarding Saudi Arabia’s Cyber Frontlines s the digital world continues to evolve at a breakneck pace, the question on everyone's mind A is, How do we protect ourselves in this ever- expanding cyber landscape? In the quest for answers, we turn our spotlight on Tariq Al-Shareef, a luminary in the field of cybersecurity whose journey is not just a career but a commitment to fortifying the digital realm. Tariq's journey started when he graduated from the esteemed King Fahd University of Petroleum and Minerals with a degree in electrical engineering. He went to the National Information Center for his first professional experience, where he became well-versed in the complex Let’s delve into the tale of a lifelong learner and advocate field of information technology. He had no idea that this for secure technological advancements! first action would set off a series of events that would transform the cybersecurity landscape forever. Could you please tell us about SiFi and its inception story? The turning point came when Tariq transitioned to the dynamic field of cybersecurity, specifically as an Incident SiFi was founded by His Excellency Ahmed Alhakbani with Response Analyst. This early exposure not only honed his the vision of revolutionizing enterprise financial skills but also laid the groundwork for his subsequent roles. management in the Kingdom. SiFi offers a comprehensive His invaluable contributions as an Incident Response suite of solutions that address the key challenges of Consultant at SITE were instrumental in addressing enterprise finance management, empowering enterprises to national cyberattacks in Saudi Arabia, showcasing his grow and thrive. prowess in the ever-evolving battlefield of cybersecurity. Tariq's trajectory further unfolded in the financial sector, What are the key challenges that organizations face in where he collaborated with ENBD, leaving an indelible terms of information security today and how do you mark on the industry. His exceptional skills and strategic address them in your role as a CISO? acumen paved the way for his current role as the Chief Information Security Officer (CISO) at SiFi. In this The cybersecurity landscape presents a formidable array of influential position, he stands as a guardian of digital challenges, each with its own unique complexities and fortresses, navigating the complex landscape of varying degrees of severity depending on the organization’s cybersecurity and steering strategies to safeguard vital industry and size. These challenges have fueled a global information. 36 January, 2024 www.thecioworld.com

39. The Most Influen?al CISOs of the Year 2024 Tariq Al-Shareef Chief Informa?on Security Officer SiFi 37 January, 2024 www.thecioworld.com

40. market worth an estimated 150 billion USD in 2021 as organizations worldwide strive to fortify their digital defenses against the ever-evolving threat landscape. While cybersecurity challenges manifest in diverse forms, certain issues transcend individual organizations, demanding a coordinated response at the national level. One such issue is the global shortage of skilled cybersecurity professionals, while another is the escalating cost of cybersecurity services and solutions. As a CISO and cybersecurity expert, my paramount responsibility is to empower the organization to thrive while adhering to the applicable regulatory framework and ensuring the protection of information assets against cyber threats. This entails a comprehensive approach to identifying, prioritizing, and mitigating cybersecurity risks, ensuring that these risks are effectively communicated to the executive management team. The overarching challenge I face lies in striking a delicate balance between compliance and risk reduction without unduly straining the organization’s resources. How do you ensure the confidentiality, integrity, and availability of sensitive data within your organization? As a CISO in the financial industry, I am mandated to adhere to all applicable regulatory frameworks and industry standards. These frameworks and standards are intended to safeguard the confidentiality, integrity, and availability (CIA) of our organization’s data and systems. It is my duty to ensure that all CIA controls are implemented, effective, and measured, and that comprehensive cybersecurity hygiene is adopted. As well as to translate the cyber risks into a language that is well understood by the board. What strategies do you employ to stay updated with the latest security threats and emerging technologies? Cybersecurity is a rapidly evolving field, with new technologies and threats emerging at a rapid pace. This can make it difficult to stay up-to-date and maintain a comprehensive understanding of the threat landscape. However, several steps can be taken to maintain awareness of the latest developments in cybersecurity. One step is to read periodic reports published by cybersecurity companies and to follow new cybersecurity research. Additionally, reading cybersecurity blogs, following cybersecurity experts on social media, and connecting with field experts can provide valuable insights into the latest 38 January, 2024 www.thecioworld.com

41. threats and trends. Finally, participating in cybersecurity In your opinion, what are the most essential security conferences can offer an opportunity to learn about new controls that every organization should have in place? technologies and trends, as well as to network with other cybersecurity professionals. Many accredited standards identify the essential cybersecurity controls based on the industry. In Saudi Can you provide an example of a successful security Arabia, the National Cybersecurity Authority has developed incident response you have managed? How did you the Essential Cybersecurity Controls, which outline the handle the situation, and what measures did you take to fundamental controls that organizations must implement. mitigate the impact? Due to their limited resources, I believe that SMEs should While I’m constrained from discussing specific incidents prioritize security controls that reduce the attack surface from my previous and current roles, I can share that I have and protect against automated attacks. This includes extensive experience as a digital forensic and incident implementing a vulnerability management program, response consultant. In this capacity, I have assisted deploying essential security controls such as firewalls as numerous clients in effectively responding to cyber well as web application firewalls, and applying best breaches and remediating the damage caused by these practices such as hardening standards and configuration. attacks. Additionally, organizations should enforce endpoint A common shortcoming observed during my experience is protection on all assets by implementing endpoint detection the absence of adequate monitoring on affected servers. and response (EDR) and advanced antivirus solutions to This lack of visibility leaves critical systems vulnerable to protect against malware and ransomware. undetected intrusions and potential data breaches. Additionally, the failure to promptly apply patches for How do you collaborate with other departments, such as known high-severity vulnerabilities creates exploitable IT, legal, and compliance, to ensure a holistic approach entry points for malicious actors. These vulnerabilities, if to information security? left unaddressed, can serve as easy targets for attackers to exploit, potentially compromising sensitive data and The collaboration should be embedded in the organization’s disrupting operations. Furthermore, the lack of proper culture. Working in a startup, which is a high-caliber network segmentation and duty segregation can amplify the environment, made this part easy for me. To make sure that impact of breaches. By segmenting networks and people work together well, it is important to have clear implementing clear segregation of duties, organizations can rules and guidelines that explain everyone’s roles and limit the scope of potential damage and minimize the responsibilities. This will help to avoid confusion and make spread of unauthorized access. sure that everyone is working towards the same goals. How do you approach building a strong security culture It is also important to clearly explain tasks to each within the organization and what steps do you take to department so that everyone knows what they need to do ensure that all employees are aware of their roles and and what the expected outcome is. This will help to avoid responsibilities in maintaining information security? misunderstandings and make sure that everyone is working on the same page. Creating a strong cybersecurity culture in an organization is a top-down endeavor. The CISO must ensure that the board of directors and executive management are fully committed to cybersecurity, as this is essential for employee adoption. Once this commitment is made, awareness programs should be established to educate employees about the threats posed by cyberattacks. This will help to create a culture of awareness and preparedness, which is essential for implementing and maintaining the best cybersecurity practices. 39 January, 2024 www.thecioworld.com

43. Subscription CIO

44. www.thecioworld.com