“This is a time of extraordinarily high visibility for security issues and security leadership, and that means this is a unique opportunity to shift your position in the organization.”

“Security and risk leaders must not only defend the enterprise but go on the offensive to help the enterprise take advantage of a wide variety of new opportunities to help them respond to an ever-changing world of threats.”

“The best coaches in the world are viewed as honest brokers: you’re the person that we can go to when we’re not sure what’s going on and get your advice and expertise to help take us to the next level.”

“Go on the offensive and take control of your leadership brand. Think about three words your CEO would use to describe you today, and then how you would prefer they describe you three months from now.” 

“Go on the offensive regarding who you work with and what you work on. Focus on partnering with business customers by being clear about their job on the team.”

“Coach executives through these tough digital uncertainties in this time of volatility, reframe your culture, embrace your role as that cultural leader, and win together by delivering on cost, revenue and risk.”

“Unknown or hidden exposures are perceived as less risky because we cannot assess the impact of the risk these have to business.”

“To calculate risk, assess how vulnerable, visible and valuable the asset is.”

“Ransomware attackers are becoming highly sophisticated in their attacks. They are entrepreneurs who are fine-tuned to make money from the attack.”

“Ransomware defense is a verb not a noun. It is a program of activities and not a thing that one can simply go out and purchase.”

“Security hygiene when deployed, monitored and managed can make your organization more resistant to threats.” 

“While security tools are important, a more holistic strategy is required to plan for effective defense.” 

“Respond in a ransomware specific way - you need something that is specific to the particular threat. Have a way to recover.”

“Transfer responsibilities to DevOps teams where feasible.or example, vulnerability management, testing, services, threat modeling, but ensure SecOps has an oversight role.”

“If you can move to a situation where your attack surface is so high that only a sophisticated zero-day or an intelligence agency in another country is able to get in, you’ve broken 90% of the threat actors on the internet.”

“The goal of vulnerability management is not to patch the most vulnerabilities, but rather to identify and address the threats that are most likely to be exploited against that particular organization.”

“Attackers primarily focus on a small number of vulnerabilities that can be reliably exploited at the lowest cost to achieve their outcomes.”

“Participation in vulnerability management is hybrid. It does not need a dedicated team residing directly in a security operations center, but rather a combination of stakeholders from various business units who would be able to make decisions at every stage of the vulnerability management process.”

“There is no way to manage exposure without proper visibility.”

“You cannot boil the ocean. Determine the high-value assets and where critical data is located and focus efforts there.”