Embedded Files
The Mental Models that every CISO should master
The Mental Models that every CISO should master
Anand Thangaraju, Field CISO, ePlus Inc.
Anand Thangaraju, Field CISO, ePlus Inc.
Abstract:
Abstract:
As a Chief Information Security Officer (CISO), the ability to navigate the complexities of modern cybersecurity and risk management relies on how effectively you can process information, identify risks, and make informed decisions. George Box's statement, “All models are wrong, but some are useful,” underscores the importance of adopting mental models as powerful tools for simplifying complex realities. We explore 10 essential mental models that every CISO should master - to enable decision-makers to rapidly interpret data, anticipate risks, and create more resilient security strategies. From recognizing the limitations of risk assessments (Map Is Not The Territory) to applying First Principles Thinking for innovation, and employing Probabilistic Thinking to assess threat likelihoods, these models sharpen decision-making and foster adaptive leadership.
As a Chief Information Security Officer (CISO), the ability to navigate the complexities of modern cybersecurity and risk management relies on how effectively you can process information, identify risks, and make informed decisions. George Box's statement, “All models are wrong, but some are useful,” underscores the importance of adopting mental models as powerful tools for simplifying complex realities. We explore 10 essential mental models that every CISO should master - to enable decision-makers to rapidly interpret data, anticipate risks, and create more resilient security strategies. From recognizing the limitations of risk assessments (Map Is Not The Territory) to applying First Principles Thinking for innovation, and employing Probabilistic Thinking to assess threat likelihoods, these models sharpen decision-making and foster adaptive leadership.
About the Speaker:
About the Speaker:
Anand is a seasoned technology evangelist and servant leader, renowned for his expertise connecting the dots across AI, Cybersecurity, Risk Management and Fintech. Throughout his career, he has collaborated closely with CIO/CISO/CTO/CDOs as a fellow practitioner, consultant (vCISO) and currently as a Field CISO representing a channel partner for major OEM vendors. His impactful presence as an industry thought leader is underscored by his contributions as a speaker at leading industry events including ISACA, ISC2, OWASP, CSA, C-Vision etc. Anand’s engagement with key security bodies like NIST, CFF, CSFI, PBC, CyberTheory, significantly shapes security policies and promotes better cybersecurity practices. Anand is also a distinguished board member, strategic angel and a limited partner in several startups and venture capital firms, specializing in B2B SaaS. As a proud alumnus of the prestigious Indian Institute of Management Ahmedabad and a continuous learner, he continues to maintain active certifications including CISSP, CIPM, AWS and advises on the Boards of Dominican Univ of California and SJSU. Beyond his professional pursuits, he is an amateur vocalist and a world citizen having travelled across 47+ countries and 6 continents. With a keen eye for innovation and a knack for strategic thinking, Anand continues to make a significant impact in the world of technology and venture capital, driving growth and transformation in the ever-evolving digital trust landscape.
Anand is a seasoned technology evangelist and servant leader, renowned for his expertise connecting the dots across AI, Cybersecurity, Risk Management and Fintech. Throughout his career, he has collaborated closely with CIO/CISO/CTO/CDOs as a fellow practitioner, consultant (vCISO) and currently as a Field CISO representing a channel partner for major OEM vendors. His impactful presence as an industry thought leader is underscored by his contributions as a speaker at leading industry events including ISACA, ISC2, OWASP, CSA, C-Vision etc. Anand’s engagement with key security bodies like NIST, CFF, CSFI, PBC, CyberTheory, significantly shapes security policies and promotes better cybersecurity practices. Anand is also a distinguished board member, strategic angel and a limited partner in several startups and venture capital firms, specializing in B2B SaaS. As a proud alumnus of the prestigious Indian Institute of Management Ahmedabad and a continuous learner, he continues to maintain active certifications including CISSP, CIPM, AWS and advises on the Boards of Dominican Univ of California and SJSU. Beyond his professional pursuits, he is an amateur vocalist and a world citizen having travelled across 47+ countries and 6 continents. With a keen eye for innovation and a knack for strategic thinking, Anand continues to make a significant impact in the world of technology and venture capital, driving growth and transformation in the ever-evolving digital trust landscape.
Security Operations - The Black Art of the SOC
Security Operations - The Black Art of the SOC
Erik Bloch, VP Security, Illumio
Erik Bloch, VP Security, Illumio
Abstract:
What is a SOC and what does it really do?
What is a SOC and what does it really do?
- Let’s look at work that flows into a SOC and what the outcomes it delivers.
- Let’s look at work that flows into a SOC and what the outcomes it delivers.
Who works in a SOC and what type of skills do they have?
Who works in a SOC and what type of skills do they have?
- What skill sets usually reside in your SOC, and how to leverage them correctly to achieve your desired outcomes.
- What skill sets usually reside in your SOC, and how to leverage them correctly to achieve your desired outcomes.
How do you correctly scope the size of a SOC and measure its capacity?
How do you correctly scope the size of a SOC and measure its capacity?
- Prevent burnout, and make sure you’re not overwhelming your SOC function.
- Prevent burnout, and make sure you’re not overwhelming your SOC function.
How does a SOC work internally, and how do they decide what to look at?
How does a SOC work internally, and how do they decide what to look at?
- With thousands of alerts and requests, how do we prioritize what they should work on, and just as importantly not work on
- With thousands of alerts and requests, how do we prioritize what they should work on, and just as importantly not work on
Why do people work in a SOC?
Why do people work in a SOC?
- With the high levels of burn out and traditionally low job satisfaction, why do people keep wanting to do this work?
- With the high levels of burn out and traditionally low job satisfaction, why do people keep wanting to do this work?
About the Speaker:
Erik founded and led the first CSIRT team at Cisco Systems. He was a senior leader in the massive Security Operations function at Salesforce, and ran all of Security Operations for Sprinklr and Atlassian. He has over 20 years’ experience in the Security Operations space and has published research and metrics to help improve and mature these functions.
Page updated
Report abuse