Inside the CISO Role: Cyber Security Threats, Trends & Tactics
“Security is not a project. Security transcends technology…it never stops.”
—Randy Becker, Vice President, Security Operations & Chief Information Security Officer
In this interview, Becker discusses the pivotal role of the modern CISO and the strategies that digital-era organizations are implementing to protect their businesses in an increasingly dangerous threat landscape.
As GreenPages’ VP of Security Ops & CISO, how do you see your role when it comes to helping clients?
I help guide customers to make informed decisions about cyber security. When our customers come to us with challenges, my role is to advise and provide recommendations and solutions. One thing that I believe separates GreenPages is that we ask “why?”
How does asking “why” change the outcome?
If we don’t ask the client why they’re considering a specific security solution, then we could be providing a completely incorrect solution that doesn’t meet the client’s business goals or future vision. You can’t provide a sound strategy and solution without thoroughly understanding what your client needs and why.
You served as CTO at GreenPages prior. How has your experience, both as CTO and in your 25+ years in IT, uniquely prepared you for this role?
I have had the fortunate experience to engage in hundreds of projects, many of which involved private and hybrid cloud solutions that incorporated security from the start, including regulatory PCI-DSS and HIPAA requirements. Having a strong technical background, business acumen, and security expertise across a broad array of technology areas allows me to help our customers make informed decisions. You’ve got to be a well-rounded individual.
Security should be engrained in everything an organization does; it should be secure by design rather than sprinkled in at the end.
What is the role of a CISO, in your own terms?
Ultimately, a CISO is responsible for managing risk. The CISO communicates to senior leadership who may have to accept those risks. Think about an insurance policy. There’s a formula for calculating risks. There’s also a point where you could go overboard by implementing over-the-top controls that affect employees and customers by inhibiting agility. It’s a delicate balance to provide both to the company but it’s a goal that every CISO and security operations professional has.
Can you give me breakdown of what you do?
Sure. Here’s a list:
- Develop policies and procedures that provide adequate business application protection without negatively affecting business velocity (agility)
- Guide the business to make informed decisions instead of simply saying “no”
- Identify, protect, detect, respond, and recover incident management, response, and messaging in the event of a breach
The CISO role is noteworthy in that it is both inward and outward facing. Can you discuss those responsibilities and how they may reinforce one another?
GreenPages is a Managed Cloud Solution Provider, and as such we have certain requirements we adhere to including SOC 2. For our clients, that means we have the appropriate controls in place to ensure the security of our systems and confidentiality of client information. For our team, it means we’re committed to operational excellence and transparency, and must work on a regular basis to ensure we meet those requirements and update as needed.
The nice thing about this is that as we internally go through these processes, audits, assessments, vulnerability scanning, and penetration testing, I can share real-world results and experiences with our customers. If you go through the process you’re much more knowledgeable than someone who just talks about it.
Download our recent webinar, “Blueprint for Hybrid Cloud Success: Use Cases You Can Apply Now”
What trends do you see in the cybersecurity market?
Cybersecurity is continuing to change. The bad guys are in it for money and are constantly looking to evade and exploit any security measures a company may put in place—always searching for new ways to stay ahead of the good guys. Ransomware was really big last year, and it still is; businesses continue to fight this. Cryptojacking is the next hot threat. Ransomware may be a one-and-done event, but cryptomining continues to run/mine until detected.
What has changed?
Well, applications and servers can now be deployed in the public cloud very easily. This means that modern organizations have an expanded attack surface which needs to be regulated and governed properly and securely.
Tell me about new advances and toolsets in the security space.
Artificial intelligence and machine learning technologies are readily available in the public cloud. For example, Symantec’s Targeted Attack Analytics (TAA) tool or Sophos’s Intercept X tool. And while it’s great that these AI and machine learning products are available and ready for use, the issue is that the bad guys can also leverage these tools.
Any final thoughts?
Security is not a project. A project has a well-defined beginning and end. New technologies and threats hit the market daily and security skill sets, strategies, and approaches need to keep pace with fluid and ever-changing requirements. Security transcends technology; security never stops.
Interviewed by Jennifer Goolkasian, GreenPages Business Development Representative
About Randy Becker, Vice President, Security Operations & Chief Information Security Officer
Randy has more than 25 years in the IT industry, with strong expertise in cyber security and risk management; security operations and optimization; infrastructure modernization; and hybrid cloud architecture, design, and implementation.
Randy is responsible for GreenPages’ overall cyber security strategy, including developing comprehensive policies and procedures to protect critical applications while ensuring business agility and velocity. He also leads GreenPages’ security engineering team, overseeing monitoring, auditing, vulnerability identification, incident management, testing, and reporting. In addition, Randy educates and trains the user community on best practice defense strategies to minimize risk.
Working closely with clients, Randy designs and implements solutions that enable IT organizations to successfully combat threats and shrink their attack surface in an increasingly dangerous and dynamic cyber security landscape. He also develops cyber security strategies to help clients contain and remediate threats and ensure industry-specific and federal compliance mandates are met.
Randy has held the roles of CTO, CIO, Enterprise Architect, Enterprise Consultant, and Consulting Architect and has designed, implemented, and supported extremely complex technology solutions in a variety of verticals. His certifications include VCP 6 DCV; CCNP; MCITP; Citrix Certified Expert; and Citrix Certified Professional.
