Ask HN: What knowledge and skills should a Head of Security possess?

Re:Ask HN: What knowledge and skills should a Head of Securi... by watwut on Monday September 25, 2017 @03:15PM (#15333170)

1.) Politics - ability to negotiate, ability to convince. Experience with management - ability enforce the rules and create organization that follows them. Ability to write down understandable rules. (There is no security if employees dont follow the instruction and share passwords with each other.) That means creating structures for employees learning including lessons etc, understands incentives, knows how to verify things are done the way they should.

2.) Politics two - ability to plan, think ahead and gauge risk vs cost (unless you are CIA you dont aim for zero risk). Follow up plan, have plans about what to do after incident including PR and know that such plan is needed.

3.) Knows big picture security. Knows various standards, what they are good for, how much they cost, their weaknesses and whether they are good idea for your company. Understands what rules in those standards are for and whether they apply.

4.) Lower picture security - knows what is pen testing, intrusion detection a bit about networks etc etc. Does not need to be expert and configure the stuff from top of head, but needs to understand what his/her people are talking about when they talk. Needs ability to distinguish between bullshit and fact.

[ Parent | on HN ]

Re:Ask HN: What knowledge and skills should a Head of Securi... by PaulHoule on Monday September 25, 2017 @03:17PM (#15333193)

Politics can be a double-edged sword. "Avoiding conflicts" is an unreasonably effective strategy until it stops working.

[ Parent | on HN ]

Re:Ask HN: What knowledge and skills should a Head of Securi... by watwut on Monday September 25, 2017 @05:06PM (#15334147)

Being good in politics does not imply avoiding conflicts. It implies effective approach to them. Most importantly, ability to diffuse the conflict and ability to find solution that satisfy multiple parties is not conflict avoidance - it is rational approach instead of emotional angry one. The direct angry confrontation is sometimes part of conflict solution too, if you have that kind of personality, but even there you need to control yourself enough not to make complete fool out of you - and know when not to do so. Which is pretty easy for angry people.

The other part of politics is understanding what other people are up to and why they are doing what they are doing. Knowing who can make decisions, who can be trusted in what, who is stubbornly refusing change and thus it is waste of time trying to convince him etc.

[ Parent | on HN ]

Re:Ask HN: What knowledge and skills should a Head of Securi... by PaulHoule on Monday September 25, 2017 @06:08PM (#15334611)

I agree, but "avoiding conflicts" can make somebody look good at politics, until...

[ Parent | on HN ]

Re:Ask HN: What knowledge and skills should a Head of Securi... by castillar76 on Monday September 25, 2017 @03:24PM (#15333260)

I would say instead, "Manage conflicts". That is, be able to constructively disagree with management above, below, and at your level, manage a reasonable discussion while advocating strongly for your position, and accept defeats and later "told you so" moments with grace and class.

[ Parent | on HN ]