Author Biography
Table of Figures
Introduction
Chapter 1: Prove Yourself Ready Now
Chapter 2: Team Development and Retention
Chapter 3: Program Maturity
Chapter 4: Influence Support and Funding
Chapter 5: Cyber Threat Intelligence
Chapter 6: Third Party Risk Management
Chapter 7: Metrics and Reporting
Chapter 8: Insider Risk Monitoring and Response
Chapter 9: Threat Landscape and Controls Analysis
Chapter 10: Conduct an Assessment
Chapter 11: Crisis Communications
Chapter 12: Control by Governance
Appendix
Index
References
Biography
Gideon T. Rasmussen is a cybersecurity leader with over 20 years of experience in corporate and military organizations. Gideon has designed and led programs including Information Security (CISO), PCI - Payment Card Security, Third Party Risk Management, Application Security and Information Risk Management. He has diverse cybersecurity industry experience within banking, startups, insurance, pharmaceuticals, DoD/USAF, aerospace and defense, state government, advertising and talent management.
Gideon is a sought-after speaker, addressing audiences at conferences, universities and coporate events. He has authored the book Program Architecture: Fight the Good Fight. A veteran of the United States Air Force, Gideon has completed the Bataan Memorial Death March four times.
Gideon T. Rasmussen
Cybersecurity Executive | Program Architect
CISSP, CRISC, CISA, CISM, CIPP
So, what’s the good fight? The opening suggests that it is about moving up but it quickly becomes clear that it is just not a fight for moving up —but building a very different skills set and mindset required to transition from a staff—technically focused—position to a management role. From that point the goal is to leverage that position over the long term to methodically build defenses around their organization’s information systems to protect the quality and reliability of their organization’s data from the ever evolving external and internal cybersecurity threats. Rasmussen brings decades of experience to his task and the attention to detail and the chapters on landmines tell me that he has learned from his mistakes; readers benefit from both.
In this regard, Rasmussen’s makes clear in the opening pages that in this high risk operating environment managers move from the margin’s to their organization’s center stage and assume responsibilities—and risks—that will only grow in scope and importance. Understanding yourself and making the commitment to move “across the table”—I call it flipping the switch—are only the start. Once on board Rasmussen sets the highest priorities starting with focusing on their employees and building bridges to often non-technical seniors that will determine their direction, pace and funding levels.
The themes of communicating across the organization and His emphasis on careful planning, setting objectives and measuring progress across multiple tasks rum through the text.
Rasmussen’s structure, flow, and clear methodical explanations make the detailed text readily accessible and easy to use. Coverage is comprehensive and his path is easily tracked upfront in table of contents, the list of figures, and the index (yes, the index). He sets out his path in the introduction and first chapter—Chapter Two takes readers through monthly tasks for a year--that give readers a clear sense of his program’s multiple dimensions and how they fit together. These tasks are mutually reinforcing and giving them short shrift leaves increases risk. A short but well curated bibliography that includes well known leadership and management books point to additional resources.
Rigor, discipline and the hard work of management ripple through the pages. Rasmussen’s project management bent is clear; careful planning and metrics drive the process. Each chapter explores a single component of his overall approach. They start with a summary of what’s ahead and then ties it to the overall planning process. Implementation is broken down step-by-step into brief sequentially numbered subsections each with a bold heading that together provide a high level roadmap at a glance.
The use of planning tools and matrices—almost 80 are spread throughout the chapters—are used to push managers to be deliberate in their planning and reinforce the importance of developing themselves , their employees, and building out their cyber programs step by step. In this way each component becomes a separate program that is also part of the whole—lots of moving parts. Quantitative and qualitative data populate the matrices against objectives and track progress over time. They can be challenging and time consuming to fill in, but there is no other way to manage the complexies of implementation.
Importantly, Rasmussen’s matrixed approach extends to developing a communications plan for management that starts on day one and moves forward with guidance on, for example, the challenges of balancing employee privacy with counter insider threats. He is most thorough in coaching managers through preparations for briefing managers during the budget planning process. challenges of briefing nontechnical managers.
To broaden its reach and utility readers would have benefitted from transitioning into different settings would/would not impact his planning process. For example, what would be the first steps for a new manager that is the first-ever a first-ever cyber hire, inherits a small team, or arrives amidst a major data breech or merger? For these and other new managers in similar situations Rasmussen’s broadly gauged multifaceted approach may or may not be the best fit.
To be fair, however, moving into these areas might well have disrupted Rasmussen’s tight focus on transition. But these are important questions that would serve him well in his next outing. Indeed, readers can’t help but think he has more to say and we should look forward to that.
Jay Grusin, PhD
