Roshan Popal

WP_Query Object
(
    [query] => Array
        (
            [post_type] => Array
                (
                    [0] => post
                    [1] => webinars
                )

            [posts_per_page] => -1
            [post_status] => publish
            [meta_query] => Array
                (
                    [relation] => OR
                    [0] => Array
                        (
                            [key] => new_authors
                            [value] => "81"
                            [compare] => LIKE
                        )

                    [1] => Array
                        (
                            [key] => new_presenters
                            [value] => "81"
                            [compare] => LIKE
                        )

                )

        )

    [query_vars] => Array
        (
            [post_type] => Array
                (
                    [0] => post
                    [1] => webinars
                )

            [posts_per_page] => -1
            [post_status] => publish
            [meta_query] => Array
                (
                    [relation] => OR
                    [0] => Array
                        (
                            [key] => new_authors
                            [value] => "81"
                            [compare] => LIKE
                        )

                    [1] => Array
                        (
                            [key] => new_presenters
                            [value] => "81"
                            [compare] => LIKE
                        )

                )

            [error] => 
            [m] => 
            [p] => 0
            [post_parent] => 
            [subpost] => 
            [subpost_id] => 
            [attachment] => 
            [attachment_id] => 0
            [name] => 
            [pagename] => 
            [page_id] => 0
            [second] => 
            [minute] => 
            [hour] => 
            [day] => 0
            [monthnum] => 0
            [year] => 0
            [w] => 0
            [category_name] => 
            [tag] => 
            [cat] => 
            [tag_id] => 
            [author] => 
            [author_name] => 
            [feed] => 
            [tb] => 
            [paged] => 0
            [meta_key] => 
            [meta_value] => 
            [preview] => 
            [s] => 
            [sentence] => 
            [title] => 
            [fields] => 
            [menu_order] => 
            [embed] => 
            [category__in] => Array
                (
                )

            [category__not_in] => Array
                (
                )

            [category__and] => Array
                (
                )

            [post__in] => Array
                (
                )

            [post__not_in] => Array
                (
                )

            [post_name__in] => Array
                (
                )

            [tag__in] => Array
                (
                )

            [tag__not_in] => Array
                (
                )

            [tag__and] => Array
                (
                )

            [tag_slug__in] => Array
                (
                )

            [tag_slug__and] => Array
                (
                )

            [post_parent__in] => Array
                (
                )

            [post_parent__not_in] => Array
                (
                )

            [author__in] => Array
                (
                )

            [author__not_in] => Array
                (
                )

            [search_columns] => Array
                (
                )

            [ignore_sticky_posts] => 
            [suppress_filters] => 
            [cache_results] => 1
            [update_post_term_cache] => 1
            [update_menu_item_cache] => 
            [lazy_load_term_meta] => 1
            [update_post_meta_cache] => 1
            [nopaging] => 1
            [comments_per_page] => 50
            [no_found_rows] => 
            [order] => DESC
        )

    [tax_query] => WP_Tax_Query Object
        (
            [queries] => Array
                (
                )

            [relation] => AND
            [table_aliases:protected] => Array
                (
                )

            [queried_terms] => Array
                (
                )

            [primary_table] => wp_posts
            [primary_id_column] => ID
        )

    [meta_query] => WP_Meta_Query Object
        (
            [queries] => Array
                (
                    [0] => Array
                        (
                            [key] => new_authors
                            [value] => "81"
                            [compare] => LIKE
                        )

                    [1] => Array
                        (
                            [key] => new_presenters
                            [value] => "81"
                            [compare] => LIKE
                        )

                    [relation] => OR
                )

            [relation] => OR
            [meta_table] => wp_postmeta
            [meta_id_column] => post_id
            [primary_table] => wp_posts
            [primary_id_column] => ID
            [table_aliases:protected] => Array
                (
                    [0] => wp_postmeta
                )

            [clauses:protected] => Array
                (
                    [wp_postmeta] => Array
                        (
                            [key] => new_authors
                            [value] => "81"
                            [compare] => LIKE
                            [compare_key] => =
                            [alias] => wp_postmeta
                            [cast] => CHAR
                        )

                    [wp_postmeta-1] => Array
                        (
                            [key] => new_presenters
                            [value] => "81"
                            [compare] => LIKE
                            [compare_key] => =
                            [alias] => wp_postmeta
                            [cast] => CHAR
                        )

                )

            [has_or_relation:protected] => 1
        )

    [date_query] => 
    [request] => 
			SELECT   wp_posts.*
			FROM wp_posts  INNER JOIN wp_postmeta ON ( wp_posts.ID = wp_postmeta.post_id )
			WHERE 1=1  AND ( 
  ( wp_postmeta.meta_key = 'new_authors' AND wp_postmeta.meta_value LIKE '{ded2c52cb92c54642934eff56755a7f4a6843cbc38b9976b7f63c66eda2f2e28}\"81\"{ded2c52cb92c54642934eff56755a7f4a6843cbc38b9976b7f63c66eda2f2e28}' ) 
  OR 
  ( wp_postmeta.meta_key = 'new_presenters' AND wp_postmeta.meta_value LIKE '{ded2c52cb92c54642934eff56755a7f4a6843cbc38b9976b7f63c66eda2f2e28}\"81\"{ded2c52cb92c54642934eff56755a7f4a6843cbc38b9976b7f63c66eda2f2e28}' )
) AND wp_posts.post_type IN ('post', 'webinars') AND ((wp_posts.post_status = 'publish'))
			GROUP BY wp_posts.ID
			ORDER BY wp_posts.post_date DESC
			
		
    [posts] => Array
        (
            [0] => WP_Post Object
                (
                    [ID] => 21295
                    [post_author] => 81
                    [post_date] => 2021-02-16 07:00:33
                    [post_date_gmt] => 2021-02-16 07:00:33
                    [post_content] => 
One of the major challenges CISOs, like myself, face today is finding balance between keeping a business running efficiently versus the security controls implemented. It is an ongoing challenge that takes time to figure out. But, as we all know, time is not something that is readily available to CISOs.



To help, Nabil Hannan, NetSPI Managing Director and a former colleague of mine, invited me to share insights on his Agent of Influence podcast. From the conversation, here are my top tips for achieving balance and, in turn, eliminating friction between business and cyber security.



Create realistic security awareness campaigns – and learn from them



Phishing engagements are a great opportunity to keep people on their toes while garnering awareness around email security. One particular engagement I coordinated was so effective, it fooled our security team. Our phishing emails were deployed at the same time as our real security awareness training and tricked people into clicking on a “malicious” link to confirm they had completed the company-wide training. Over 70 percent of people in the company fell for it.



We learned a few lessons from this engagement.



First, security practitioners are not immune to phishing attacks. There is a misconception that security teams are immune to being hacked or compromised. It is important to find curious and creative methods of security awareness training to challenge not only your general employees, but also your security teams.



Second, someone had said to me, “I will never trust an email from you again.” And I thought about that for a long time - and still do to this day. How do we as security practitioners create effective training campaigns without losing some level of trust? Well, it's not necessarily a bad thing for people to be skeptical. People can be easily tricked when their guard is down. When we receive an email from an outside source nowadays we are much more cautious when opening attachments or clicking on links. But if an email appears to come from your friendly HR team, manager, or CEO, we are much more comfortable clicking on a link or opening an attachment.



Third, cybercriminals are getting more creative, and our security awareness engagements should too. More now than ever we need to imitate real-world attacks using the latest attack tactics, techniques, and procedures (TTPs). Had this been a real attack, if somebody had access to our email system, they would have known that the real security training email had gone out that day. And they could have easily distributed the exact email and captured many usernames and passwords. Our engagement was not far from how an advanced persistent threat (APT) would work.



Finally, as with many things in life, security is circumstantial. From a business perspective, it is important to understand your user base and change your security approach accordingly. Every company’s user base is different. Your security offerings, penetration testing, and training are all circumstantial based on the type of users you have. Account for organizational cultural norms when making security decisions.







Prioritize risk – while also moving the business forward



In my first three months as a CISO, there were outstanding tasks and projects to complete. To prioritize my focus, I took a step back and looked at what the risks to the business were. By prioritizing my tasks based on the biggest business risks, securing the business came naturally.



Every CISO should ask themselves, “How can I help make the business move faster, while staying secure?” This is an interesting question because security is almost inverse of being able to go fast. However, we have made great strides over the past 10 to 15 years where we can now have a level of transparency, while maintaining an adequate level of security. This allows for a frictionless experience where things happen fast in an organization, such as DevOps.



During my conversation with Nabil, he explained this well. He said, “Recently, I read something that really resonated with me. It took me back to the early days where we would say, ‘security is just a subset of quality.’ If you think about it that way, if we are doing quality correctly, security goes along hand in hand. Similarly, I think if you're doing DevOps correctly, you shouldn't need DevSecOps. If you're doing DevOps correctly, security should be part of that process already. Security really needs to be frictionless and needs to focus on how to be secure while still enabling the business and enabling people to move ahead.”



Understand the business – and how it makes money



When I first became a CISO, the most valuable advice I received was, “you need to understand how the business makes money, that's the most important job of a CISO.” If you can understand how the business makes money, then you're able to protect the business's critical assets and transactions.



And that's exactly what I did when I came to MicroStrategy. I followed the guidance of my mentors. CISOs, especially first time CISOs, should have mentors to help them understand their role formally, hear real-world experiences, and learn what others have gained from being in a similar position. One book I recommend to any CISO is CISO Leadership: Essential Principles for Success from ISC². It digests the thought process behind the CISO role. The first half of the book explains the role of the CISO and the second provides real scenarios and examples of how CISOs dealt with different technology and security challenges.



The CISO role is really a business position, a leadership position. It is not about the tooling or the firewalls – your job is to reduce company risk. Different organizations have different appetites for risk. Once you understand that, everything else will fall into place.



Click here to listen to my full interview with Nabil. Or you can find Agent of Influence on Spotify, Apple Music, or wherever you listen to podcasts.

                    [post_title] => How To Eliminate Friction Between Business and Cyber Security
                    [post_excerpt] => Top tips for keeping a business running efficiently while also implementing security controls, from MicroStrategy CISO Roshan Popal.
                    [post_status] => publish
                    [comment_status] => closed
                    [ping_status] => closed
                    [post_password] => 
                    [post_name] => eliminate-friction-business-cyber-security
                    [to_ping] => 
                    [pinged] => 
                    [post_modified] => 2022-12-16 10:50:59
                    [post_modified_gmt] => 2022-12-16 16:50:59
                    [post_content_filtered] => 
                    [post_parent] => 0
                    [guid] => https://www.netspi.com/?p=21295
                    [menu_order] => 366
                    [post_type] => post
                    [post_mime_type] => 
                    [comment_count] => 0
                    [filter] => raw
                )

        )

    [post_count] => 1
    [current_post] => -1
    [before_loop] => 1
    [in_the_loop] => 
    [post] => WP_Post Object
        (
            [ID] => 21295
            [post_author] => 81
            [post_date] => 2021-02-16 07:00:33
            [post_date_gmt] => 2021-02-16 07:00:33
            [post_content] => 
One of the major challenges CISOs, like myself, face today is finding balance between keeping a business running efficiently versus the security controls implemented. It is an ongoing challenge that takes time to figure out. But, as we all know, time is not something that is readily available to CISOs.



To help, Nabil Hannan, NetSPI Managing Director and a former colleague of mine, invited me to share insights on his Agent of Influence podcast. From the conversation, here are my top tips for achieving balance and, in turn, eliminating friction between business and cyber security.



Create realistic security awareness campaigns – and learn from them



Phishing engagements are a great opportunity to keep people on their toes while garnering awareness around email security. One particular engagement I coordinated was so effective, it fooled our security team. Our phishing emails were deployed at the same time as our real security awareness training and tricked people into clicking on a “malicious” link to confirm they had completed the company-wide training. Over 70 percent of people in the company fell for it.



We learned a few lessons from this engagement.



First, security practitioners are not immune to phishing attacks. There is a misconception that security teams are immune to being hacked or compromised. It is important to find curious and creative methods of security awareness training to challenge not only your general employees, but also your security teams.



Second, someone had said to me, “I will never trust an email from you again.” And I thought about that for a long time - and still do to this day. How do we as security practitioners create effective training campaigns without losing some level of trust? Well, it's not necessarily a bad thing for people to be skeptical. People can be easily tricked when their guard is down. When we receive an email from an outside source nowadays we are much more cautious when opening attachments or clicking on links. But if an email appears to come from your friendly HR team, manager, or CEO, we are much more comfortable clicking on a link or opening an attachment.



Third, cybercriminals are getting more creative, and our security awareness engagements should too. More now than ever we need to imitate real-world attacks using the latest attack tactics, techniques, and procedures (TTPs). Had this been a real attack, if somebody had access to our email system, they would have known that the real security training email had gone out that day. And they could have easily distributed the exact email and captured many usernames and passwords. Our engagement was not far from how an advanced persistent threat (APT) would work.



Finally, as with many things in life, security is circumstantial. From a business perspective, it is important to understand your user base and change your security approach accordingly. Every company’s user base is different. Your security offerings, penetration testing, and training are all circumstantial based on the type of users you have. Account for organizational cultural norms when making security decisions.







Prioritize risk – while also moving the business forward



In my first three months as a CISO, there were outstanding tasks and projects to complete. To prioritize my focus, I took a step back and looked at what the risks to the business were. By prioritizing my tasks based on the biggest business risks, securing the business came naturally.



Every CISO should ask themselves, “How can I help make the business move faster, while staying secure?” This is an interesting question because security is almost inverse of being able to go fast. However, we have made great strides over the past 10 to 15 years where we can now have a level of transparency, while maintaining an adequate level of security. This allows for a frictionless experience where things happen fast in an organization, such as DevOps.



During my conversation with Nabil, he explained this well. He said, “Recently, I read something that really resonated with me. It took me back to the early days where we would say, ‘security is just a subset of quality.’ If you think about it that way, if we are doing quality correctly, security goes along hand in hand. Similarly, I think if you're doing DevOps correctly, you shouldn't need DevSecOps. If you're doing DevOps correctly, security should be part of that process already. Security really needs to be frictionless and needs to focus on how to be secure while still enabling the business and enabling people to move ahead.”



Understand the business – and how it makes money



When I first became a CISO, the most valuable advice I received was, “you need to understand how the business makes money, that's the most important job of a CISO.” If you can understand how the business makes money, then you're able to protect the business's critical assets and transactions.



And that's exactly what I did when I came to MicroStrategy. I followed the guidance of my mentors. CISOs, especially first time CISOs, should have mentors to help them understand their role formally, hear real-world experiences, and learn what others have gained from being in a similar position. One book I recommend to any CISO is CISO Leadership: Essential Principles for Success from ISC². It digests the thought process behind the CISO role. The first half of the book explains the role of the CISO and the second provides real scenarios and examples of how CISOs dealt with different technology and security challenges.



The CISO role is really a business position, a leadership position. It is not about the tooling or the firewalls – your job is to reduce company risk. Different organizations have different appetites for risk. Once you understand that, everything else will fall into place.



Click here to listen to my full interview with Nabil. Or you can find Agent of Influence on Spotify, Apple Music, or wherever you listen to podcasts.

            [post_title] => How To Eliminate Friction Between Business and Cyber Security
            [post_excerpt] => Top tips for keeping a business running efficiently while also implementing security controls, from MicroStrategy CISO Roshan Popal.
            [post_status] => publish
            [comment_status] => closed
            [ping_status] => closed
            [post_password] => 
            [post_name] => eliminate-friction-business-cyber-security
            [to_ping] => 
            [pinged] => 
            [post_modified] => 2022-12-16 10:50:59
            [post_modified_gmt] => 2022-12-16 16:50:59
            [post_content_filtered] => 
            [post_parent] => 0
            [guid] => https://www.netspi.com/?p=21295
            [menu_order] => 366
            [post_type] => post
            [post_mime_type] => 
            [comment_count] => 0
            [filter] => raw
        )

    [comment_count] => 0
    [current_comment] => -1
    [found_posts] => 1
    [max_num_pages] => 0
    [max_num_comment_pages] => 0
    [is_single] => 
    [is_preview] => 
    [is_page] => 
    [is_archive] => 
    [is_date] => 
    [is_year] => 
    [is_month] => 
    [is_day] => 
    [is_time] => 
    [is_author] => 
    [is_category] => 
    [is_tag] => 
    [is_tax] => 
    [is_search] => 
    [is_feed] => 
    [is_comment_feed] => 
    [is_trackback] => 
    [is_home] => 1
    [is_privacy_policy] => 
    [is_404] => 
    [is_embed] => 
    [is_paged] => 
    [is_admin] => 
    [is_attachment] => 
    [is_singular] => 
    [is_robots] => 
    [is_favicon] => 
    [is_posts_page] => 
    [is_post_type_archive] => 
    [query_vars_hash:WP_Query:private] => 8cc8e5f2dc7b256945cbbe9f3da58871
    [query_vars_changed:WP_Query:private] => 
    [thumbnails_cached] => 
    [allow_query_attachment_by_filename:protected] => 
    [stopwords:WP_Query:private] => 
    [compat_fields:WP_Query:private] => Array
        (
            [0] => query_vars_hash
            [1] => query_vars_changed
        )

    [compat_methods:WP_Query:private] => Array
        (
            [0] => init_query_flags
            [1] => parse_tax_query
        )

)

Executive Blog Security Industry Trends

How To Eliminate Friction Between Business and Cyber Security

Roshan Popal

February 16, 2021