Connect with us

Global Banking and Finance Review is an online platform offering news, analysis, and opinion on the latest trends, developments, and innovations in the banking and finance industry worldwide. The platform covers a diverse range of topics, including banking, insurance, investment, wealth management, fintech, and regulatory issues. The website publishes news, press releases, opinion and advertorials on various financial organizations, products and services which are commissioned from various Companies, Organizations, PR agencies, Bloggers etc. These commissioned articles are commercial in nature. This is not to be considered as financial advice and should be considered only for information purposes. It does not reflect the views or opinion of our website and is not to be considered an endorsement or a recommendation. We cannot guarantee the accuracy or applicability of any information provided with respect to your individual or personal circumstances. Please seek Professional advice from a qualified professional before making any financial decisions. We link to various third-party websites, affiliate sales networks, and to our advertising partners websites. When you view or click on certain links available on our articles, our partners may compensate us for displaying the content to you or make a purchase or fill a form. This will not incur any additional charges to you. To make things simpler for you to identity or distinguish advertised or sponsored articles or links, you may consider all articles or links hosted on our site as a commercial article placement. We will not be responsible for any loss you may suffer as a result of any omission or inaccuracy on the website. .


The CISO as the Man-in-the-Middle


Michael-ThelanderMichael Thelander, Director of Product Management, Tripwire

If you’ve been working in or around the IT security field for any amount of time, you are probably quite familiar with the term “Man-in-the-Middle” (MitM) as it relates to a method of attack.

What I’m even more interested in these days is an emerging typology, the new Man-in-the-Middle – or what I like to describe as being the “MitM Redux” – and in this context we are not referring to an attack method, but instead applying the term to describe a role that is becoming all the more common.

Security practitioners and infosec students who have crammed for the CISSP and GISP certification exams understand MitM to be a type of crypto attack that is usually explained by using the now ubiquitous characters Alice, Bob, and Mallory.

In the parable, Alice thinks she’s communicating privately with her friend Bob, but in actuality the malicious Mallory has secretly inserted herself in the middle of the conversation and is effectively eaves dropping on them, and in some instances she is able to also modify some the messages as she relays them between the two unwitting conversants.
The Man-in-the-Middle attack at one point in time was considered to be quite innovative, but not so much today. Would-be miscreants who want to utilize the technique can now simply buy the components “off the shelf” to carry out such an attack by employing ready-made toolkits like Ettercap, dsniff, and Mallory (a creative use of the classic MitM character’s name).

As interesting as they are, the goal of this discussion is not to further examine Man-in-the-Middle as an attack, but instead I seek to expand the terminology to describe the new CISO, who has become the real Man-in-the-Middle, increasingly finding him or herself caught between two very different worlds.

The first of which is the Executive World, where they need to be able to connect security to the business by practicing the soft art of Influence Without Power when speaking to a new audience in terms of critical business functions, of how security risks translate into business risks, of profit/ loss considerations, and EBITDA – and if you know what the abbreviation means, then you are most likely already an MitM CISO.

The second and more familiar world is that of the Technical, where the CISO must continue to effectively communicate in terms of the attack surface, of incident management, of controls and control objectives, of CIS benchmarks, and network defense testing.

Many security and business analysts have attempted to qualify the dynamics of this evolving role for the new CISO, but in my honest opinion none have done a better job at it than the authors of a study conducted by IBM’s Center for Applied Insights, aptly titled “Finding a Strategic Voice: Insights from the 2012 IBM Chief Information Security Officer Assessment” (the detailed results of which can be downloaded here at no cost).

The IBM report offers up some excellent data and provides some useful findings, some examples of which I found particularly interesting and included:

  • The Focus is Shifting Towards Risk Management:“In two years, security leaders expect to be spending more of their time on reduction of potential future risk, and less on mitigation of current threats and management of regulatory and compliance issues.”
  • The Archetypes are Real: CISOs and security leaders can be grouped into archetypes which include Responders, Protectors and Influencers, and each persona has a very distinct modus operandi in regards to working with and through their organizations. The report does a great job of not only fleshing out these different archetypes; it also provides keen insight into how one can morph from one archetype to the others.
  • A Shift in Focus from the Local to the Global: “In general, the role of information security will be moving away from specific risks to global risks. The role will be much larger than it used to be,” the authors noted.
  • Measures Really Matter:Think of this as gaining insight from the process of obtaining metrics, and not just from the numbers themselves. “Although metrics can be a challenge to define and capture, that should not deter organizations from implementing them. Measurement may be imprecise at first but will improve over time – and the process itself can drive valuable insight,”the report states.

I saw a lot of reports last year on the evolution that is defining the role of the new CISO, but this report is by far the best in show. 

In the most general of terms, it illustrates the choice most all CISOs will face: Whether to continue being the “middleman” who translates up the chain and manages down through the organization while never really getting to land on one side or the other, or instead being more like the innovative CIOs and CFOs who before them had struggled to assume their rightful place at the strategy table, but only after mastering the soft skills required for executive leadership.

I think most CISOs will opt for the latter of the two choices, and it is up to those of us who call ourselves security “vendors” and “professionals”to assist them in making this important transition.

Tripwire is exhibiting at Infosecurity Europe 2013, the No. 1 industry event in Europe held on 23rd – 25th April 2013 at the prestigious venue of Earl’s Court, London. The event provides an unrivalled free education programme, exhibitors showcasing new and emerging technologies and offering practical and professional expertise. For further information please visit




Global Banking & Finance Review


Why waste money on news and opinions when you can access them for free?

Take advantage of our newsletter subscription and stay informed on the go!

By submitting this form, you are consenting to receive marketing emails from: Global Banking & Finance Review │ Banking │ Finance │ Technology. You can revoke your consent to receive emails at any time by using the SafeUnsubscribe® link, found at the bottom of every email. Emails are serviced by Constant Contact

Recent Post