Your team is pushing back on cybersecurity updates. How can you ensure a smooth digital strategy rollout?

I think we are far beyond the convincing stage of patching our systems to IT functions. The real solution is to change the reporting structure of the CISO Org and IT to ensure IT is following CISO strategy. Until this is done, there will always be competing priorities and excuses/politics.

When you speak about education. I believe you have to show the team why the update is important. especially to IT to let them understand why the update is important to them by increasing the availablity for the system.

In my experience I've never had a hard time convincing staff that patching is necessary. The challenge has been people and personality management as well the corresponding required soft skills necessary to achieve a mutually successful outcome. Each organization will have it's own appetite for risk. Furthermore any given leader will have their own unique tolerance for how long they are willing to let a "critical" vulnerability exist in situ behind what has been deemed as adequate mitigation controls. The key here is to remember that this is not a zero sum game, and the flexibility is paramount. "Don't let perfect be the enemy of good." as they say.

According to me, regular patching keeps you safe from known vulnerabilities. As a CISO instead of convincing the IT team one has to educate them. Awareness about the importance of patching is more important. Also, patching is the joint responsibility of CISO and IT team one can never deny this.

Let's go back to the source. Who creates secure and less secure code if not the developers? The trend towards the use of high-level programming languages disconnects humans from the way the machine actually works, creating discrepancies and distortions that are corrected after the fact by security patches. Another shortcoming may lie in the weakness of post-development functional and technical testing. Delivering a secure product is a duty, and management should provide the resources for it. ‘Prevent better than cure’ goes the proverb. But who applies it in real life, and under what spurious pretexts is it deviated from? Detecting it and redirecting it towards anticipation is certainly the biggest challenge facing the security team.

One thing I have found helpful is getting into the shoes of the IT team and understanding their pain. Reasons for resistance and understanding points where you can use your expertise to relieve IT team blockers.

Transform resistance into resilience by actively involving your team in shaping new security measures. Engage team in development, gather feedback through pilot programs, and provide hands-on training to build ownership and understanding. Have them help shape these changes by clearly communicating long-term benefits like enhanced data protection and reduced breach risk. This hands-on, collaborative approach eases the transition and fosters a culture of cybersecurity awareness and cooperation. P.S. Schedule updates during off-peak hours to minimize disruptions.

Sometimes security based changes can break things especially if developers are going gung ho on developing it the fastest way (usually means least secure). Then people like me have to come in and audit their systems and make sure they are deploying it in a secure way and sometimes that means going back and testing those security changes in staging and dev environments to ensure it doesn’t break stuff. And sometimes it does and that requires refactoring code which then requires partnership with eng leads to accomplish.

Automation is critical to process improvements. before automation can be effective, we must have visibility. Asset inventory, cloud services, code repos and low code/ no code services must be considered in the asset inventory. Identify, prioritize, automate and verify.

I think the right process can solve any problem. Setting the right process with automation of patching wherever possible is key. 1. Create proper test beds w.r.t your IT environment. 2.Getting the right patches, CVEs. 3. Patching schedule based on PROD/DEV/QUA environments. 4. Roll back plans are some of the key points which one has to consider before settling patching process

To ensure a smooth digital strategy rollout when your team is pushing back on cybersecurity updates, streamline the processes involved. Simplify the implementation steps and clearly outline the necessary actions. In my experience, breaking down complex updates into manageable tasks reduces resistance and confusion. Use intuitive tools and interfaces that integrate seamlessly with existing workflows, minimizing disruption. Provide clear documentation and step-by-step guides to support the transition. By making the process straightforward and user-friendly, you can alleviate concerns and foster a cooperative environment, ensuring that cybersecurity measures are adopted efficiently and effectively.

Patches should be done every week. Even if they are offset for a week or 2 to test them first. Updates for versions should be evaluated every quarter, or every month if possible. Sometimes updates break things and it’s important to test updates before releasing in production

We had this thing where if an employee clicks a phishing email they get free training 😇😉 Also whats a better incentive than not getting hacked and sued for millions of dollars for data malpractice? 😅 “Alright guys if everyone patches their computers by Tuesday night we all get to go home feeling safe and secure, you can’t buy that!”

En una de nuestras implementaciones de ciberseguridad más complejas, decidimos incentivar la adopción con un enfoque innovador. Creamos un sistema de recompensas donde los empleados que adoptaran las nuevas medidas de manera proactiva recibían reconocimientos y pequeñas recompensas, como días libres adicionales. Este enfoque no solo aceleró la adopción, sino que también creó un ambiente positivo donde los empleados competían amistosamente por seguir las mejores prácticas.

Engaging the CTO and CISO for any security changes is important to get buy in for initiatives. As a security leader I would regularly meet with the CTO for regular updates and to establish trust and acquire but in for security changes that affect other orgs. Then they would suggest what other people should be involved and then assign them accordingly and prioritize it for them, which is key.

He visto de primera mano cómo el liderazgo efectivo puede influir en la adopción de nuevas medidas de seguridad. En un proyecto anterior, nuestros líderes fueron los primeros en adoptar las nuevas políticas de ciberseguridad, mostrándose como ejemplos a seguir. No solo instalaron las actualizaciones de inmediato, sino que también participaron activamente en las sesiones de capacitación y hablaron abiertamente sobre la importancia de estas medidas en reuniones de equipo. Esta actitud motivó a otros empleados a seguir su ejemplo, ya que veían que la alta dirección también estaba comprometida con el cambio, lo que generó una mayor aceptación y confianza en el proceso.

To drive home the importance of cybersecurity updates, share real-world examples of companies that faced significant losses due to cyber attacks. Highlight how these incidents could have been prevented with timely updates. For instance, when a major retailer suffered a data breach due to outdated security measures, it resulted in millions of dollars in losses and damaged customer trust. By illustrating the tangible consequences of neglecting updates, your team will better understand the critical role these measures play in protecting your organization.

Un aspecto crucial que he incorporado en cada despliegue de estrategia digital es la retroalimentación continua. Recuerdo una situación en la que, después de implementar una nueva herramienta de seguridad, recibimos comentarios de varios miembros del equipo sobre pequeñas dificultades que estaban enfrentando. En lugar de esperar a que los problemas se acumularan, establecimos un canal de comunicación directo y constante para que pudieran reportar sus experiencias en tiempo real. Esto nos permitió realizar ajustes inmediatos y mejorar el proceso de adopción. Además, al escuchar sus opiniones y actuar sobre ellas, el equipo se sintió valorado y más involucrado en la implementación de la estrategia.