The Top 10 Skills CISOs Need in 2024

The role of the chief information security officer (CISO) has never been more important to organizational success. The present and near-future for CISOs will be marked by breathtaking technical advances, particularly those associated with the inclusion of artificial intelligence technologies being integrated into business functions, as well as emergent legal and regulatory challenges.  Continued advances in generative artificial intelligence (AI) will accelerate the proliferation of deepfakes designed to erode public trust in online information and public institutions. Furthermore, these challenges will be amplified by an unstable global theater in which nefarious actors and nation states chase opportunities to exploit any potential organizational weakness. Some forecasts have already characterized 2024 as a pressure cooker environment for CISOs. In such an environment, skills are critical. In this post I outline the top 10 skills that CISOs need for 2024 and beyond. These recommendations draw upon my experience as the director of the SEI’s CERT Division, as well as my service as the first federal chief information security officer of the United States, leading cyber operations at the U.S. Department of Homeland Security, and my lengthy military service as a communications and cyberspace operations officer. </p

Secure by Design at CERT

A troubling development in the cyber realm is society’s acceptance of the expectation that all software is released with defects that must be dealt with through patches, most of which follow exploitation of weaknesses in the software by nefarious actors. In a recent address to the nation from Carnegie Mellon University, Jen Easterly, director of the Cybersecurity Infrastructure Security Agency (CISA), noted that this “normalization of deviance” has meant that we are accepting software products that fail to approach our own standards for safety. In her address, Easterly cited work by Diane Vaughn, who wrote about the 1986 Challenger disaster and the decisions leading up to it. Vaughan’s book characterized an environment in which people become so accustomed to a deviant behavior that they don't consider it as deviant. Unfortunately, as Easterly noted, we have become inured to ransomware and cyber attacks, so she called upon technology and software producers to shift left and incorporate security earlier in the development lifecycle to ensure that robust security is a feature of every product that the public, military, and government uses.   A troubling development in the cyber realm is society’s acceptance of the expectation that all software is released with defects that must be dealt with through patches, most of which follow exploitation of weaknesses in the software by nefarious actors. In a recent address to the nation from Carnegie Mellon University, Jen Easterly, director of the Cybersecurity Infrastructure Security Agency (CISA), noted that this “normalization of deviance” has meant that we are accepting software products that fail to approach our own standards for safety. In her address, Easterly cited work by Diane Vaughan, who wrote about the 1986 Challenger disaster and the decisions leading up to it. Vaughan’s book characterized an environment in which people become so accustomed to a deviant behavior that they don't consider it as deviant. Unfortunately, as Easterly noted, we have become inured to ransomware and cyber attacks, so she called upon technology and software producers to shift left and incorporate security earlier in the development lifecycle to ensure that robust security is a feature of every product that the public, military, and government uses.   Within days of Easterly’s speech, the White House released the national cybersecurity strategy, which, among other things, calls for more expansive regulation to shift responsibility for secure software products and services onto technology manufacturers who have traditionally relied on users to configure security into their products. This notion of secure by design has been a long-standing tenet of all the work that we undertake at the SEI and, in particular, our CERT Division, which specializes in cybersecurity engineering and resilience research and development. In this post, I will highlight our continued and longstanding efforts to ensure security by design in fielded software. </p