Tenable Blog

Most modern organizations support separate IT, security and business divisions, driven by their own departmental goals, objectives, and priorities. With so much at stake, how do you get IT, Development Operations (DevOps), and security teams working together to assure compliance and business security? Scott Hollis shares his thoughts on this challenge in Aligning Operations: IT – Business - Security.

In a recent Tenable webcast, a panel of CISOs discussed why widely adopted security practices are falling short. While the focus was on higher education, attendees representing insurance companies, banks, security firms, hospitals, retail, and payment processors voiced similar challenges.

The panelists included:

All CISOs should track metrics to support their security programs. Security metrics are crucial to decision making, budgets and executive reporting. But what should be tracked besides the total number of vulnerabilities and remediations? Scott Hollis recommends two key metrics to start with, and discusses the need for contextual information in Using Security Metrics to Drive Action.

“When we’re looking at taking a containerized workload, one of the challenges with it is you lose a lot of the visibility when you’re running at scale in a virtualized environment,” said Robbie Jerrom (@robbiej), member of the Global Cloud Native Apps SME Team for VMware, after his presentation, Your DevOps Transformation. Culture, Technology, or Both? at Vmworld 2015 in San Francisco.

No matter how big a security budget is, it cannot completely prevent breaches. The goal for the CISO is to educate executives about how the benefits of the organization’s security strategy far outweigh the risk of not investing in cybersecurity measures. In Risks vs. Benefits of Security Investments Scott Hollis discusses the challenges that CISOs face when educating executives about security risks in business terms that they understand.