State of Florida - ISC

More documents

Recommendations

Info

distributing those funds.Ideally, Congressforum to make a strong business case,” says Russo.would mandate that some of the funds beallocated to information security, but withstates cutting their budgets, such allocationis unlikely to happen without strong advocacy.Florida is divided into seven domestic securityregions, each chaired by state and local law enforcementofficials. These regional committeeslook at potential terrorist activity and makerecommendations on solving security threats.Each year, those recommendations are vetted,and decisions are made on how to spend millionsof dollars that the State receives from DHS.In addition to DHS money, CISOs can findfunds for information security initiativesthrough grants from the U.S. Department ofHealth, Department of Labor and the Departmentof Education.“As the State’s CISO, it’s my job to help allMake a Strong Business CaseThe State of Florida is known to have one ofthe best domestic security initiatives in thedecision-makers realize the importance ofinvesting in their agency security teams todevelop effective information security,” said Russo.nation, and one that supports cyber issues.That success is due in large part to the abilityof CISOs to make a strong business case fortheir priorities. So, how does the Office ofInformation Security get heard over the din ofTechnology alone cannot protect sensitiveinformation, and no amount of software willever be as powerful as the people behind it, sotraining and education must be funded.voices clamoring for a piece of the funding pie?“So far,” said Russo, “we have been successfulAccording to Russo, much has to do with theway the State’s domestic security organizationis structured. It gives the State Chief InformationOfficer, the head of AEIT, a seat at thedecision-making table. “It’s up to informationsecurity leaders to make sure we use thatat establishing a consensus that our technologyand education needs are very important factors.”Russo advises CISOs in other states to finda way to bring awareness to the groups whodetermine how domestic security fundsare spent.3
“CISOs need to be excellent advocatesfor their technology and training needs,” saidRusso. “One of the mistakes we make astechnologists,” he says, “is that we don’t addressthe business needs. Business leadersmake the decisions on where money is spent,and it is our responsibility to help them understandwhy information security is critical totheir success – not in a techie way – but bymaking a strong business case for it.”RESULTSMore Qualified People“Our role is to protect information assets,”said Russo. “The (ISC) 2 Review Seminars helpensure that our people know how to do that.Earning and maintaining the credentials meansthat they not only have the required knowledgebut that they are continually updating theirknowledge in line with the constantly evolvingthreats and changes in the industry. In addition,membership in a professional certification bodyensures they have made a commitment to highethical standards. Everyone who attended theReview Seminar is more capable as a result ofit,” he said. “The (ISC) 2 instructor was incredible.He was personable, and his experienceand background provided insights and reallifeexamples that made all of the informationunderstandable and memorable.”In addition, the (ISC) 2 credentials are a part ofthe State’s career mapping process. By providinga path for employees to advance, Florida isbetter positioned to retain them as they growmore experienced.“We associate certain credentials with job descriptions,”says Russo. “They help us identifycandidates for new roles and responsibilities.”Increased Level of Professionalism“Credentials have a positive influence on ourtightly knit community of information securitymanagers,” said Russo. “Employees who haveattained credentials are held to a higher standardby the organization and their peers, andthey become evangelists, supporting othersto move toward certification. Once credentialed,they have access to all the advantages andresources available to certified professionals,which benefits the entire agency.”“We are very pleased with the results wehave achieved from the CISSP Review Seminar,”said Russo. “We will continue to offer coursesfor (ISC) 2 credentials until the majority ofthe State’s information security professionalsare certified.”4
Page 1 and 2: September 2010
Page 3: SOLUTIONEstablish GoalsFirst, AEIT

State of Florida - ISC

Create successful ePaper yourself

Delete template?

Save as template?