Microsoft Security Matters - Aug 2020

I think Abbas Kudrati 's article on what one needs these days to make a successful run at CISO is excellent and I couldn't agree more. All too often, I've seen highly gifted security experts promoted into these roles only to fail miserably because they either lacked more comprehensive business knowledge and skills or because they simply couldn't learn them. Being a successful CSO/CISO is no longer about being a world class cybersecurity SME (sadly). As is the case with many upper level executive positions, it's increasingly crucial to not only have some "big picture" knowledge and ability, but to become as well versed in such as possible as the need to work and collaborate with people and departments one once didn't need to even think about seems to have gone the way of the dinosaur in many places, and in many companies one has to be able to see the big picture and design their various strategies with a larger and in a more cohesive manner than one once did. I recall reading an article in Forbes magazine quite awhile ago that quoted some high level CEOs as mentioning some interesting things and one really stood out to me. (In fact, since then I've acquired and read some books on this very topic.) Where long ago, "Renaissance men [gender inclusive]" were deemed valuable, over the past several decades, the trend has been to specialize to the point of one becoming an expert in one or perhaps two areas, but at the exclusion of nearly everything else. Meanwhile, those once highly regarded as Renaissance types were given the title of "generalist" and no longer so highly regarded. Yet it seems the trend is reversing and now, while SMEs in many areas are still valued and needed, many things have contributed to a greater interest and potential need for the Generalists once discarded. In fact, this Forbes article quoted some prominent leaders as saying they value Liberal Arts degrees, especially English, over something like Accounting, Mechanical Engineering, Communications Engineering (Networking/Electrical), etc., because in their opinion, many such grads have skills many others lack, such as critical thinking skills, abilities to adapt to a variety of roles and fields, as opposed to others trained in one and only one area. I find it almost ironic, because I chose to study and get degrees in a wide variety of areas ranging from English to Law to Computer Science to Electrical Engineering to Creative Writing to Software Development, etc. For awhile, I was both in high demand yet often feeling as though many SMEs looked down on me. However, now after many decades of work, as I look back, I realize many former colleagues have been successful and done much, but I have as well, but in a variety of fields and roles that many others have not had such opportunities. Thus, while working in many IT and Engineering divisions, I also worked in journalism, advertising, project and program management, security, academia, publishing, healthcare, physics, policy, as a senior executive, consulting and more, and I've had an interesting life and career as a result. So finally circling back to Kudrati 's post, if I hadn't learned -- sometimes by being thrown into the deep end -- to become knowledgeable and successful in other realms and roles than simply IT/Engineering, such as marketing, advertising, negotiating, going to bidder's conferences, etc., I doubt I would have ended up having the career I did, so I hope those who have not taken Kudrati's advice definitely consider the wisdom imparted in this blog post because it could prove to be invaluable to many.