Chief Information and Chief Information Security Officers
Plan, organise, direct, control and coordinate the ICT and cyber security strategies, plans and operations of an organisation to ensure the ICT and cyber security infrastructure supports the organisation's overall operations and priorities.
A quiet Tuesday that does not stay quiet
You are the chief information security officer of a credit union, responsible for keeping member information safe. It is 8:15am on a Tuesday. A phishing email, a board paper and a budget request all arrive within the hour, and none of them can wait long.
Choose what you would do. Then see what happens. There are often good reasons for each choice.
Three staff have told me they clicked a link in an email that looked like it came from HR. One of them typed in her password. I do not want to get her in trouble. What do you want us to do?
Reset her password, warn staff by email, and look quietly for further damage on her account
It is a reasonable start, but the other two who clicked are not checked and the quiet approach slows the warning. Speed matters more than discretion here.
Check all three accounts at once for misuse, and thank them for reporting it
Nothing sinister has happened yet, and the team can show it. Because staff were thanked, three more people mention they saw the email too. Making it safe to report is as important as the fix.
Treat it as a disciplinary matter, so staff learn to be more careful about what they click
Staff stop reporting problems, and next time someone clicks a bad link they say nothing for days. Fear is a bad security control.
We are launching a new online loan form on Friday. Your team wants another round of testing, which will push it back a fortnight. We have already told customers the date. Can you sign it off?
Sign it off so the date holds, and promise to test it after launch
The form goes live with an untested weakness. Later testing finds a flaw that could have exposed member details. Testing afterwards is much more expensive than testing before.
Refuse to sign off until all testing is finished, however long it takes
The system is safe, but Gareth feels blocked and the business pays a price for the delay. A narrower approach might have kept the date.
Agree to test the riskiest parts first and offer a date once you see what turns up
Gareth gets a realistic date and you get your priorities tested. Treating risk in order of importance lets security serve the business rather than stand in front of it.
I read the news every day and I am worried. Can you tell me we are secure? Please do not give me a technical lecture. I just need to know whether I can sleep at night.
Say yes, we are well protected and the team is watching the systems, to put her mind at rest
The reassurance feels good, but no organisation is completely secure. When an incident later occurs, the board remembers being told it was impossible.
Explain the biggest risks in plain words, what you are doing and what still worries you
Eleanor does not get a perfect assurance, but she gets a picture she can trust and questions she can ask. Honest, plain talk builds a board that backs you when you need money.
Offer a detailed technical report covering every system and let the board read it in their own time
Everything is in there, but nobody reads fifty pages and Eleanor still does not know where she stands. Information is not the same as understanding.
How it went
By the end of the day the phishing links are closed off, the loan form has a sensible plan and the board member has an honest answer. Security leaders protect people and trust, not only systems, and have to explain risk without causing panic. Does that mix of technology and judgement sound like you?
This is a simplified, fictional situation to help you explore. It is not professional instruction or a test of your ability.
Case study: The alert at 2am
A fictional case set in the technology and security leadership team of a fictional regional credit union.
The situation
Chief information security officer Rania Aziz was woken at 2am by a call from her night analyst at Coastal Union Credit. Unusual activity had been spotted on a system holding member details. It might be nothing, or someone might be quietly testing the doors. If she shut down the system, members would be locked out of their accounts when the morning rush began. If she waited and the concern was real, more information could be at risk. She had perhaps an hour to choose.
What they did
Rania asked three calm questions: what do we know, what do we not, and what can we do that is easy to undo? She had the analyst isolate just the affected part of the system rather than closing everything, and woke the chief executive with a short message that said what was known and what was being done. The team kept notes of every action, so they could explain them later.
How it turned out
The activity turned out to be an old test account that had been left running, not an attack. Still, the team found two other weak points while checking. Rania's report to the board led with what the night had taught them and what they would change, not with relief.
What would you do?
- Why was it wise to take a step that could be reversed instead of shutting everything down?
- Would you have woken the chief executive at 2am, and why or why not?
- How do you think a security leader decides when something is serious enough to disturb people?