Leadership and Talent – Kevin L. McLaughlin, PhD

“Mastering the Interplay: The Role and Culture of a Cyber Physical Security (CPS) Professional in Global Cybersecurity Teams”

“In the intricate world of Cyber-Physical Systems, the role of a CPS professional is marked by a unique blend of courage and intelligence. Navigating through the complexities, they stand resilient against challenges, armed with intellectual prowess, and fortified by a collaborative and learning-driven culture. As we venture further into this dynamic field, it is the courage to protect and our collective intelligence that fuels our success.” – Dr. Kevin Lynn McLaughlin, PhD

Abstract
Cyber-Physical Systems (CPS) are complex systems that are the foundation of technological applications such as autonomous vehicles, smart grids, medical monitoring systems, and industrial automation. Dedicated CPS teams are tasked with safeguarding the computing and networking components as well as the physical components under their purview. The task of securing a CPS is far from straightforward, presenting a unique set of challenges that demand astute attention. This article explores the role of the CPS professional. The importance of continuous learning and training is increasingly apparent, and it is important to invest in educational courses to fortify your expertise and navigate the ever-evolving landscape of Cyber-Physical Systems.

As the digital age unfolds, the confluence of the physical and cyber realms is becoming increasingly pronounced, giving rise to complex systems known as Cyber-Physical Systems (CPS). These intricate amalgamations of computation, networking, and physical processes underpin a myriad of today’s technological applications, ranging from autonomous vehicles and smart grids to medical monitoring systems and industrial automation. While CPS have unlocked new horizons in technological innovation, they also bring to light a new set of challenges in terms of cybersecurity. The task of protecting these systems from both digital and physical threats is paramount. This is where dedicated CPS professionals (CPSP), operating as part of a broader global cybersecurity structure, come into play. These specialized teams are tasked with safeguarding the computing and networking components — the ‘cyber’ part — as well as the physical components under their purview, such as Supervisory Control and Data Acquisition (SCADA) systems. With the stakes being high, CPSP’ role involves not just securing data but also averting potential physical harm that could result from a security breach. In this article, we will explore the dynamic world of CPSPs within global cybersecurity frameworks. We will delve into their pivotal role, responsibilities, and the unique challenges they face. Further, we will investigate how these teams function as part of a larger cybersecurity strategy, contributing to the robustness and resilience of modern technological infrastructure. Items such as unified system models and the compositional framework of CPS will be tangentially discussed (Bakirtzis et al., 2021). Whether you are a cybersecurity professional, a stakeholder in the manufacturing industry, or simply a technology enthusiast, this insight into CPS teams will shed light on a critical component of global cybersecurity efforts.

In a global cybersecurity team for a manufacturing company, a CPSP will have a variety of roles and responsibilities, some of which include:

CPS Security Analyst: This professional is responsible for monitoring and analyzing the company’s CPS for any signs of security breaches or vulnerabilities. They also develop and implement measures to secure the company’s CPS.

CPS Security Engineer: This role involves designing and implementing secure CPS. They work with other engineers to ensure that security is considered in all aspects of the CPS design and operation.

CPS Security Architect: These professionals design the overall security architecture of the CPS. They ensure that all components of the system are designed and configured to operate securely together.

ICS/SCADA Security Specialist: Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems are specific types of CPS used in manufacturing. Specialists in these systems focus on securing these systems from cyber threats.

CPS Risk Manager: This role involves identifying, assessing, and mitigating risks associated with the company’s CPS. This includes both cybersecurity risks and physical risks to the system.

CPS Security Compliance Officer: This professional ensures that the company’s CPS complies with all relevant security regulations and standards. They may also work on certification processes related to CPS security.

CPS Incident Responder: This professional responds to security incidents affecting the CPS. They work to contain and eliminate threats, and then recover systems to normal operation. They also conduct post-incident analysis to learn from the event and prevent future incidents.

CPS Security Researcher: In larger organizations or those with a more advanced security posture, there may be roles focused on researching new threats to CPS and developing new techniques for defending against these threats.

CPS Security Consultant: This role involves advising the organization on best practices for CPS security. They may also be involved in training other staff in CPS security.

CPS Security Manager/Director: This is a leadership role that involves overseeing the company’s CPS security strategy and managing the CPS security team.

These roles require a combination of skills in cybersecurity, systems engineering, and understanding of the physical processes being controlled by the CPS. It’s also important to understand the manufacturing environment and the specific requirements and challenges it presents for CPS security.

In the realm of technological integration, the concept of CPS emerges as a significant milestone. These systems represent an impressive fusion of computational capabilities, networking prowess, and the governance of physical processes. At their core, CPS employ embedded computers and interconnected networks that diligently oversee and manage physical operations. A noteworthy attribute of these systems is the existence of feedback loops, wherein the physical processes and computations influence one another reciprocally. A myriad of contemporary applications leverages the power of CPS, a testament to their versatility and ubiquity. The spectrum of these applications is broad, ranging from the smart grid systems that stand as the backbone of modern infrastructure, to the autonomous automobile systems that epitomize the forefront of transportation technology. Similarly, the medical sector relies heavily on CPS for patient monitoring, while the industrial realm uses these systems for effective control and management. Robotics and automatic pilot avionics also employ the robust capabilities of CPS, further demonstrating their wide applicability. Given their extensive integration and critical functionalities, the security of these CPS is of paramount importance. This domain, aptly termed Cyber-Physical System Security (CPSS), focuses on safeguarding these systems from both digital and physical threats. This protective realm encompasses not just the computing and networking components, often referred to as the ‘cyber’ part of the CPS, but also extends to the physical components under their control. The task of securing a CPS is far from straightforward, presenting a unique set of challenges that demand astute attention. CPSP professionals need to work closely with the organizations Blue Teams, Red Teams and Threat Intelligence Center (TIC) to be able to effectively do their job. CPSPs need to consider items such as how to leverage virtual and hardware-based testbeds which enable a multitude of choices for threat representation. They need to work with automated scripts that pretend to be hackers or red team members so that they can see how the manufacturing systems respond to and look like when under a cyberattack (Thorpe et al., 2022).

The stakes are high since a successful cyber-attack could lead to more than just data compromise; it could also inflict tangible physical harm. To put this into perspective, an assault on a CPS governing a power grid could precipitate a widespread power outage, causing significant disruption. Equally concerning is a potential attack on a CPS steering a self-driving car, which could result in a collision. Addressing these threats necessitates an integrated approach to CPS security, encapsulating various facets. Paramount among these is secure communication, which entails ensuring the integrity and confidentiality of the data exchanged between different components of the CPS, rendering it immune to interception or unauthorized modification. Linked to this is the aspect of authentication, which revolves around the verification of the identities of devices and users interfacing with the system, thereby forestalling unauthorized access. Of equal importance is data integrity, a fundamental pillar of CPS security. This aspect emphasizes the need for data to be accurate, dependable, and immune to unauthorized tampering. Complementing this is the resilience of the system, its ability to endure attacks or system failures, and either continue functioning correctly or swiftly recover to its operational state. CPS security also demands a focus on the physical security of the system, protecting the physical components from potential tampering, damage, or unauthorized access.

It is also crucial to respect and protect the privacy of individuals, particularly when their data is processed or impacted by the CPS. This privacy protection forms another essential element of a comprehensive security approach. The security of the software or firmware running on the system’s devices cannot be overlooked. These need to be secure, free from vulnerabilities that could potentially be exploited by malicious actors. Considering the intertwined nature of physical and cyber components in a CPS, securing them requires a multidisciplinary approach. This typically involves the amalgamation of computer science, engineering, and systems theory, highlighting the complexity and the broad scope of the field. Given this complexity, the task of ensuring CPS security demands not only technical expertise but also a deep understanding of the interactions between the cyber and physical worlds.

In the context of CPS, creating a team and leadership culture that promotes human-centered values is paramount. Drawing from the ideas presented in influential works such as “How Full Is Your Bucket?” by Tom Rath and Donald O. Clifton, “The Energy Bus” by Jon Gordon, “Servant Leadership” by Robert K. Greenleaf, and “The Radical Leap” by Steve Farber, the core themes of positive reinforcement, energy and enthusiasm, service to others, and cultivating love, audacity, and proof in leadership can be applied to foster an effective and cohesive CPS team (Farber, 2004; Gordon, 2007; Greenleaf, 1977; Rath, 2004). One of the foundational principles of a strong team culture is the concept of positive reinforcement, inspired by “How Full Is Your Bucket?”. It emphasizes the importance of mutual appreciation and recognition within the team. CPS professionals operate in an intricate, multidisciplinary field and the work can often be challenging. Positively recognizing each team member’s contributions can fill their ‘buckets’, increasing positivity, productivity, and overall satisfaction in the workplace. Drawing from “The Energy Bus,” the team culture should also be infused with positivity, enthusiasm, and shared vision. The journey of CPS professionals can be likened to a ride on an energy bus, where everyone shares the drive towards a common destination: effective and secure cyber-physical systems. Leaders can foster an ‘energy bus culture’ by encouraging a positive mindset, promoting enthusiasm for shared goals, and helping team members overcome obstacles with optimism and resilience. The principles of “Servant Leadership” can also be integrated into the team and leadership culture. In this model, leaders prioritize the growth and well-being of their team members, fostering an environment of trust and mutual respect. Servant leaders in the CPS realm are those who listen to their team’s ideas, encourage their professional development, and empower them to take ownership of their roles. This kind of leadership fosters a sense of community and shared responsibility, which is crucial when dealing with the complexities of CPS. Finally, “The Radical Leap” presents a framework that encapsulates Love, Energy, Audacity, and Proof (LEAP). Applied to CPS teams, ‘Love’ is about cultivating a deep passion for the CPS work and genuine care for each other. ‘Energy’ ties back to the principles from “The Energy Bus,” emphasizing positivity and forward momentum. ‘Audacity’ encourages CPS professionals to think boldly and innovatively, which is critical in a field that is at the forefront of technological advancements. And ‘Proof’ refers to demonstrating these values through actions, ensuring that the team’s work effectively meets the security and functionality demands of CPS. A successful team and leadership culture for CPS professionals is one that encourages positive reinforcement, harnesses collective energy, emphasizes servant leadership, and embodies the principles of LEAP. It is a culture that places people at its core, recognizing that the strength of a team lies not just in their technical skills, but also in their shared values, mutual respect, and collective drive towards a common goal.

As we delve deeper into the world of CPS, the importance of continuous learning and training becomes increasingly apparent. Whether you are a seasoned CPSP looking to stay abreast of the latest advancements or a novice aiming to break into the field, investing in educational courses is a critical step. These courses not only equip CPSP’ with the knowledge and skills to tackle real-world challenges but also set them apart in a competitive job market. The rich tapestry of CPS and its security spans a multitude of areas, including secure communication, authentication, data integrity, resilience, physical security, privacy, and secure software or firmware. As such, the choice of training courses should reflect these diverse facets, offering a balanced blend of theoretical knowledge and practical application. Moreover, given the multidisciplinary nature of CPS, a professional in this field benefits immensely from a wide range of courses. These courses may touch upon areas such as computer science, engineering, systems theory, and cybersecurity, all of which are integral to the field of CPS. With these considerations in mind, let us explore some of the training courses that a CPSP should consider taking to fortify their expertise and navigate the ever-evolving landscape of CPS.

Coursera: They offer numerous courses on cybersecurity and some specific ones on IoT security, which can be relevant to CPS. Some universities, like the University of Colorado Boulder, offer specializations like “Hardware Security” which covers security aspects of embedded systems, a core component of CPS (Wade et al., 2015).

edX: edX also has a wide variety of courses on cybersecurity. The University of Maryland, for instance, offers a professional certificate in cybersecurity.

Udemy: There are courses related to Industrial Control System (ICS) and SCADA Security, which are a critical subset of CPS.

ISA Global Cybersecurity Alliance: ISA offers training and certificate programs focused on industrial cybersecurity.

SANS Institute: They offer a range of cybersecurity courses, including ICS and SCADA security training.

CyberSecurity Academy: They offer a variety of courses, including ones that focus on IoT Security.

Professional Certifications: You may also consider professional certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Ethical Hacker (CEH), and others that can provide a foundation of cybersecurity knowledge that can be applied to CPS.

Remember that the field of CPS security is multidisciplinary and constantly evolving. CPSPs should keep abreast of the latest research and development in this field, and the courses and certifications can help provide the necessary foundational and advanced knowledge.

Effective collaboration between a CPSP and plant manufacturing support and system engineering teams calls for an intricate blend of technical proficiency, clear communication, mutual respect, and a shared vision. An initial step towards achieving this harmony lies in fostering clear and consistent communication. CPSPs often grapple with complex concepts that may seem overwhelming to those outside their field. Therefore, it becomes incumbent on them to distill these intricate ideas into digestible information that resonates with the manufacturing and engineering teams. This is not just about simplifying jargon or technical terms but involves conveying ideas with clarity and precision. CPSPs need to realize that communication is not a one-way street, it is equally important for practitioners to actively listen and comprehend the insights, ideas, and concerns of the manufacturing and engineering teams. This reciprocation of understanding not only facilitates smoother execution of defensive items but also nurtures a culture of mutual respect. Mutual respect forms the bedrock of successful cross-functional collaboration. By acknowledging and valuing the expertise that the manufacturing and system engineering teams bring to the table, CPSPs can foster a relationship of trust and cooperation. This respect must also extend to the work processes and protocols of the other teams, encouraging a cooperative integration of workflows and assistance. Having a shared vision is a potent tool for aligning the efforts of CPSP and manufacturing teams. This involves defining common goals, aligning on expectations, and jointly strategizing paths forward. By actively cultivating a shared understanding of what needs to be achieved, the teams work in unison towards a common goal, navigating challenges together and celebrating shared successes. Another effective technique lies in promoting a problem-solving mindset across all teams. When issues arise, instead of resorting to blame, it is crucial to jointly focus on identifying the root cause and devising solutions. A CPSP can take the lead in fostering this mindset, promoting constructive discussion and mutual learning. CPS teams should try to understand the manufacturing process and system engineering principles in-depth which will enable them to design and implement more effective CPS and foster a deeper connection with the manufacturing and engineering teams. The path to effective collaboration with plant manufacturing support and system engineering teams involves clear and reciprocal communication, near real-time system monitoring, mutual respect, shared vision, a problem-solving mindset, and a deep understanding of manufacturing and engineering principles (Khanna et al., 2023). By incorporating these techniques, a CPS professional can contribute to a collaborative, efficient, and innovative work environment.

The realm of CPS presents a thrilling landscape where the digital and physical realms intertwine. As we have explored throughout this article, CPSPs play a vital role in shaping the future of technology by integrating computation, networking, and physical processes. They navigate the complexities of CPS with a multidisciplinary approach, leveraging their technical expertise, effective communication, and collaboration skills to bridge the gaps between various teams and disciplines. The core of CPS lies not only in technological advancements but also in the people who drive them. The team and leadership culture within the CPS domain must embody values such as clear communication, mutual respect, continuous learning, and a strong focus on security. Drawing inspiration from renowned works like “How Full Is Your Bucket?” and “Servant Leadership,” CPS professionals are empowered to create an environment that fosters positive reinforcement, energy, audacity, and a commitment to service. Working seamlessly with plant manufacturing support and system engineering teams requires a delicate balance of technical proficiency, clear communication, mutual respect, and shared vision. By embracing techniques such as effective communication, fostering mutual respect, promoting a problem-solving mindset, and gaining a deep understanding of the manufacturing process, CPS professionals can establish strong collaborative partnerships that pave the way for successful integration of CPS into manufacturing environments. The journey of a CPSP is one of resilience, innovation, and the audacity to push the boundaries of what is possible. It is a journey fueled by a passion for technological advancement, a commitment to security, and a deep appreciation for the transformative impact CPS can have on society. As we move forward into an era where CPS continues to evolve and shape the world around us, let us embrace the challenges, seize the opportunities, and cultivate a culture that empowers CPS professionals to drive innovation, collaborate across disciplines, and safeguard the future of technology. Working together, we can create a world where the seamless integration of the digital and physical realms enhances our lives, propels industries forward, and paves the way for a brighter and more connected future.

Bakirtzis, G., Fleming, C. H., & Vasilakopoulou, C. (2021). Categorical Semantics of Cyber-Physical Systems Theory. ACM Trans. Cyber-Phys. Syst., 5(3). https://doi.org/10.1145/3461669

Farber, S. (2004). The Radical Leap. Wiley.

Gordon, J. (2007). The Energy Bus. Wiley.

Greenleaf, R. K. (1977). Servant Leadership. Paulist Press.

Khanna, K., Ravikumar, G., & Govindarasu, M. (2023). Defense-in-Depth Framework for Power Transmission System against Cyber-Induced Substation Outages Texas Power and Energy Conference (TPEC), Texas.

Rath, T. (2004). How Full is Your Bucket. Gallup Press.

Thorpe, J., Fasano, R., Galiardi Sahakian, M., Gonzales, A., Hahn, A., Morris, J., Ortiz, T., Reinbolt, H., & Vugrin, E. D. (2022). A Cyber-Physical Experimentation Platform for Resilience Analysis Proceedings of the 2022 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems, https://doi.org/10.1145/3510547.3517916

Wade, J., Cohen, R., Blackburn, M., Hole, E., & Bowen, N. (2015). Systems Engineering of Cyber-Physical Systems Education Program Proceedings of the WESE’15: Workshop on Embedded and Cyber-Physical Systems Education , articleno = 7 , numpages = 8, https://doi.org/10.1145/2832920.2832927

“Unlocking Leadership Excellence: One Cybersecurity Executive’s Guide to Essential Reads for Aspiring Team Leaders”

“In the pursuit of leadership excellence, the wisdom gleaned from the works of esteemed authors can serve as a guiding beacon, empowering aspiring team leaders to navigate the complexities of the cybersecurity landscape with confidence, agility, and foresight.” – Kevin Lynn McLaughlin, PhD

As a cybersecurity executive, I’m frequently asked what books aspiring team leaders should read to enhance their leadership skills and elevate their teams. In response to these inquiries, I’ve decided to share my thoughts on the most insightful and transformative works in the realm of leadership and management through this blog post. These literary gems, penned by renowned authors such as Blanchard, Covey, Greene, Senn Delaney, Maxwell, Rath, Collins, and others, offer invaluable wisdom that can be applied to hone our leadership abilities and foster high-performing teams in the ever-evolving cybersecurity landscape.

In a time where fast-paced technological advancements and growing competition constantly push organizations to adapt, the pursuit of maintaining high-performing teams has become a crucial mission for leaders at all levels. The wealth of leadership and management wisdom accumulated over the years, such as the works by Blanchard, Covey, Delaney, Greene, Maxwell, Rath, Collins, and others, offers valuable insights that can be utilized to improve our leadership abilities. As cybersecurity executives and experts, it’s essential for us to explore the ideas and principles presented in these books, incorporate the core aspects of leadership, and translate this knowledge into practical strategies that will nurture, empower, and transform our team members into a unified, high-performing group that excels in their mission.

The foundation of effective leadership, as explained in the One Minute Manager series, lies in striking the right balance between clear communication, motivation, and empowerment. Throughout the different iterations of Blanchard’s work, he emphasizes the need for setting expectations, offering timely feedback, fostering autonomy, and acknowledging the impact of praise. Consequently, leaders must be adept at articulating goals and expectations while also cultivating a culture that inspires team members to assume responsibility for their tasks and outcomes. Along with the One Minute Manager Meets the Monkey, another of Blanchard’s books that teaches how to efficiently concentrate on managing your own responsibilities without adopting everyone else’s, these works offer helpful guidance on shaping the ideal culture and behaviors within your team.Covey’s influential book, “The 7 Habits of Highly Effective People”, encourages leaders to develop self-awareness, embrace proactive actions, and search for win-win solutions that benefit everyone involved. Building these habits is essential for creating a high-performing team, as it helps leaders demonstrate behaviors that promote teamwork, creativity, and personal development.

Additionally, the ideas presented in Rath’s How Full is Your Bucket emphasize the significance of positive feedback and appreciation, as they play a crucial role in fostering an environment that supports growth and builds commitment. Greene’s influential book, The 48 Laws of Power, offers a more cunning perspective on leadership. While some may argue that the tactics suggested could create a manipulative atmosphere, others believe that using these strategies wisely and ethically can strengthen one’s influence and inspire the team to achieve shared goals.

Blanchard’s High Five, Whale Done, The Secret, and The 4th Secret of the One Minute Manager all praise the values of empowerment, teamwork, trust, and purpose-driven leadership. These works emphasize the need to create an environment where team members feel encouraged to take risks, learn from mistakes, and aim for excellence. By building a culture of psychological safety, leaders can unlock their teams’ hidden potential and lead them to remarkable success.

The Arbinger Institute’s Leadership and Self-Deception offers a fresh perspective on leadership by revealing the harmful effects of self-deception and the importance of adopting an outward mindset. Combining this approach with the principles found in Maxwell’s 21 Irrefutable Laws of Leadership, Collins’ Good to Great, Johnson’s Who Moved my Cheese, and Farber’s Radical Leap enables leaders to go beyond traditional leadership methods and adopt a transformative approach that fosters growth, adaptability, and resilience.

The insights gained from these literary works provide cybersecurity executives with a comprehensive framework for nurturing high-performing teams. By embracing clear communication, empowerment, collaboration, trust, and growth, leaders can establish a culture that supports talent development, builds loyalty, and achieves success. As leaders in our field, it’s essential for us to continually invest in both our own growth and that of our team members. By applying and adapting the lessons from these leadership books, we can confidently tackle the challenges of the ever-changing cybersecurity landscape with agility and foresight. Additionally, we should recognize the importance of mentorship, as shown in Cottrell’s Monday Morning Mentoring, and commit to fostering a learning environment and ongoing improvement. As each of you progress on your leadership paths, let’s remain dedicated to excellence and draw inspiration from the insights of these esteemed authors to guide our endeavors in building and sustaining high-performing teams. By embracing these principles, we can successfully safeguard the digital realm, gain the confidence of our stakeholders, and leave a legacy within the cybersecurity profession as we foster the growth of exceptional future leaders. So, act now and incorporate these valuable lessons into your leadership practices, and together, we can shape a more secure and promising future for the cybersecurity profession and, more importantly, the talent that works in our profession.

The summary above is from these leadership books:
• The One Minute Manager Blanchard
• The One Minute Manager Meets the Monkey Blanchard
• The On-Time, On-Target Manager Blanchard
• The 48 laws of power Greene
• High Five Blanchard
• Whale Done Blanchard
• How Full is Your Bucket Rath
• 7 Habits of Highly Effective People Covey
• The 4th Secret of the One Minute Manager Blanchard
• 21 Irrefutable Laws of Leadership Maxwell
• Good to Great – * Boring and Dry but Good Collins
• The Secret Blanchard
• Leadership and Self Deception Arbinger Institute
• Great Leaders Grow: Becoming a Leader for Life Blanchard
• Helping People Win at Work Blanchard
• Who Moved my Cheese Johnson
• Self Leadership and the One Minute Manager Blanchard
• Monday Morning Mentoring Cottrell
• Developing the Leader Within You Maxwell
• Radical Leap Farber
• The Human Operating System, Delaney
• The Why Cafe

https://orcid.org/0009-0009-8367-5292

Sometimes you need a who, A what, no – a who, oh ok

It always surprises me when I meet a novice or someone who is new to a field or new to a role and they are embarrassed to ask for help. Even worse is when they are afraid that receiving feedback and being less than perfect is a sign of failure or ineptness. I always just want to say, hey let’s go grab a coffee and talk. And in that talk, I would explain to them that when you are new at something it is unrealistic to expect to know how to do the work, the task, etc. without help or in a perfect way and to think otherwise is putting so much pressure on themselves that I can’t understand how they cope.

When you are first starting an endeavor, you often need a who. No, not a what – a who. As John Strelecky wrote in his book “The Why Café” we often need a Who, a person who already has the skills and knowledge in an area to help us, if we want to become competent in a new endeavor. But here’s the thing, the same person who will get scuba lessons, take pilot lessons, go to a music teacher, etc. Is the same one that will take a new role in their work career and decide that they need to figure it out on their own because if they don’t folks will think they are not capable or that they are a failure.

So here is my advice. As a novice or someone who is new to a field or a role, it is perfectly normal to not know everything and need help. In fact, it is crucial to seek guidance and feedback, especially at the beginning of a new endeavor. Don’t be afraid to ask for help and seek out a “who” – someone who already has the skills and knowledge in the area that you want to become competent in. It is important to recognize that expecting perfection without guidance is unrealistic and can put an enormous amount of pressure on yourself. You may find yourself struggling to cope with the expectations that you have set for yourself. Just like how you wouldn’t try scuba diving without lessons or attempt to fly a plane without first taking pilot lessons, you should not expect to know everything and be able to succeed in a new role or field without seeking help. It is okay to ask questions and learn from others who have more experience. Remember, asking for help is not a sign of failure or ineptness. In fact, seeking feedback and guidance from those with more experience can help you learn and improve much faster than if you were to go at it alone. Don’t let the fear of appearing incompetent prevent you from seeking the help you need to succeed.

So, go ahead and ask for that coffee meeting with a more experienced colleague or mentor. You might be surprised at how much you can learn and grow from the experience. #seekcoaching, #becoachable

Pollyanna Leadership?

“Positive leadership isn’t just about being optimistic, it’s about acknowledging challenges while emphasizing resilience and a can-do attitude. It empowers individuals and inspires teams to take risks, embrace change, learn from mistakes and work together to overcome obstacles. Unlike authoritarian leadership, positive leadership creates a more fulfilling and satisfying work environment while driving success.”- Dr. Kevin Lynn McLaughlin, PhD

Let’s talk about positive leadership and how it doesn’t mean that leaders ignore mistakes and not hold team members responsible. Positive leadership, which creates a supportive and constructive work environment where team members feel valued and respected, is better in the long-term for team morale and retention than authoritarian or command and control leadership. This is because positive leadership fosters trust and transparency, which leads to improved communication and collaboration, increased job satisfaction, and a lower likelihood of turnover. Authoritarian leadership focuses on control and punishment, which can lead to a negative and demotivating work environment.

Positive leadership is a critical component of building a strong and successful team, but it is important to understand what it is and what it is not. Positive leadership does not mean that you never hold team members accountable or that you are always behaving in a Pollyanna manner. On the contrary, positive leadership means creating a supportive and constructive work environment where team members are encouraged to learn, grow, and succeed. This includes holding team members accountable, when necessary, but doing so in a way that is respectful, supportive, and focused on growth and improvement. Cybersecurity leadership is about creating a culture of trust and transparency, where everyone feels valued and respected. When your cybersecurity team members trust their leaders and feel valued, they are more likely to be open and honest about their challenges and mistakes, which creates opportunities for growth and improvement. This does not mean ignoring coaching for improvement and learning opportunities nor does it mean you allow them to cover up mistakes. On the contrary, positive leaders must address concerns and mistakes, learn from them, and drive on to be better. This requires leaders to be honest, transparent, and constructive in their approach. Positive leadership is about creating a supportive and constructive work environment that fosters trust, transparency, and growth.Positive leadership is not about ignoring accountability or behaving in a Pollyanna manner, but rather it is about approaching challenges and mistakes with a positive and constructive mindset. One extremely important concept in all of this is to follow the tenet of praising in public and coaching/mentoring in private. Public shame and embarrassment seldom lead to high team morale and high team retention rates.

Retaining Cybersecurity Talent

Kevin M’s Tips For Retaining Top Cybersecurity Talent

As the cybersecurity threat landscape continues to evolve, it’s important to have a talented and skilled team in place to protect your organization’s assets and data. However, finding and retaining cybersecurity talent can be a challenge.

The following best practices can help ensure your top performers stay with your organization for the long term:

Provide competitive compensation and benefits packages

This includes not only salaries and bonuses, but also benefits like healthcare, retirement plans and paid time off.

Create a supportive and inclusive work environment.

This can be done by ensuring your team members feel valued and respected. They should be able to see a clear path for professional growth and advancement within the organization. This can be achieved through regular performance evaluation, opportunities for skills development and recognition for a job well done.

Offer flexible work arrangements

This includes hybrid, remote work, and onsite options as well as flexible schedules to meet the needs of your team – which is especially important post-covid.

Develop a strong company culture

This can be done by encouraging open communication, promoting teamwork and collaboration, and fostering a sense of community amongst your team members. This not only helps to create a positive work environment, but it also helps to build strong relationships and a sense of belonging across the team.

Invest in your team’s professional development

This can be done through a comprehensive and continuous learning program that offers opportunities for your team members to expand their skills, learn about modern technologies and stay up-to-date with the latest industry trends. Offering a combination of in-person training sessions, online courses, and hands-on experiences with innovative technologies is a great way to implement this program. Providing your team with the resources and support they need to grow and develop professionally can increase job satisfaction and help foster a sense of pride and ownership within your organization.

Threat actors are working diligently every day to find new ways to compromise sensitive data and assets. Therefore, it is essential to have a strong cybersecurity team in place to protect your organization. Prioritizing the above best-practices is a great way to keep your team members engaged and motivated, which will increase the likelihood of retaining your top cybersecurity talent for the long-term.

Thank you to my friend and colleague Ibn Akbar at Nice Touch Editing Services for helping me with the edits for this entry.

Cyber Security Quotes From Kevin

Our job is to enable the business to do neat stuff such as this in a secure manner : our approach is to help them design their solution in a secure way and make recommendations that allow them to continue…. We need to be smart enough to help them while at the same time getting them to put reasonable controls in place – Kevin L. McLaughlin

“Leading through positivity means embracing challenges, addressing mistakes with a constructive mindset, and driving on to be better, together.” – Dr. Kevin Lynn McLaughlin, PhD

“A successful cybersecurity professional must strive to simplify the complex realm of cybersecurity and make it easier to navigate and understand.” – Dr. Kevin Lynn McLaughlin, PhD

“Even the most skilled warriors and cunning outlaws are not immune to mistakes, for even a ninja blinks and pirates are not perfect.” – Dr. Kevin Lynn McLaughlin, PhD

“An effective and high-performing Security Operations and Fusion Center (SOFC) is the cornerstone of a top-notch cybersecurity program.” – Dr. Kevin Lynn McLaughlin, PhD

A Note I Wrote to Someone Who Once Worked for Me

I recently had the honor to help provide a strong reference for a person who worked for me as a Cyber Analyst. She got the Senior position she was going for but was just a little worried about what they should do in order to lead a team and be a good leader. Here is what I related to this extremely competent future Cybersecurity leader.

Hi:

First and foremost – you are going to do great in your new role. I encourage you to model your leadership style after the following rule(s):

Use the leadership model of:
Am I doing the right thing
Am I doing it for the right reason
Am I doing it at the right time
Am I doing it in the right way

This is on the back of the Challenge Coin I had made up for our UC team.

Always act with Integrity and walk your talk. You don’t always need to be right but you always need to be honest with the people you lead.

Remember that “We are smarter than Me” and foster healthy discussion and debate on topics. Try to pull ideas and suggestions from those you lead who are more on the quiet side. Don’t let aggressive Type A personalities (like me) dominate the conversation.

When coming out of a meeting get your team members used to doing a 5 minute feedback session (what did we do right, wrong, what should we (or I) have done differently, etc. Remember – Feedback is a gift.

Training of your people needs to be a priority and always remember to help others be Greater Than Yourself. There is enough success out there for everyone, help grow your people so that they can be your boss some day and if that did happen they would be a good boss to work for.

Don’t hesitate to email if you have specific questions. Have confidence, breath deep and believe in yourself – you got this!

CIsO or ciSo?

In some big companies it does make sense to have a polished CISO who is responsible for working both the Boardroom and the IT Executive management group. In those cases a strong security focused Deputy CISO should be considered for the heavy Security lifting that is also required. As a CIO friend of mine told me recently both of those skills is very hard to find in a single person.

My primary concern is for mid-range and smaller companies that want a CISO and are unsure of what skill set is most needed on the part of their CISO to fight organized crime, unscrupulous competitors or nation state actors. I believe that they are making a mistake with some current hires I have observed.

A somewhat scary trend that I am starting to see is now that CISO salaries are going up companies are putting Deputy or Associate CIO’s in those positions. This makes sense if we consider human nature as the CIO’s seem to be more comfortable with someone who is not “such a security guy or girl” talking to Executive Management.

Of course this approach continues to severely downplay the S (Security) component of the CISO role and is yet another path which, IMO, will lead to failure in the fight against Cyber Criminals. In many cases we need to move to having a ciSo instead of CIsO (a catch-phrase I am trying to get to catch on) and remember that it takes trained and experienced security professionals to fight organized crime, unscrupulous competitors and nation state actors. In my opinion the S in the ciSo title needs to carry the most weight for the majority of companies in their fight against cyber crime.

What’s It Going to Take to Have Cyber Security?

Written by- Kevin L. and Kody T. McLaughlin

If you are a Cyber Security professional do you get as mad as I do when you read and hear

over and over again that Cyber Security professionals don’t have enough talent, skills, or

business acumen to effectively secure systems? I say bull! That’s right bull! In wargame

after wargame I have observed that the defending team must keep an unused port open,

or have a small exploitable vulnerability on their systems so that the attackers have a

chance and the games are interesting. What that tells me is that many of us know what to

do and we have the skills necessary to do it but there are organizational blockers that

prevent us from effectively securing the systems we are trusted to safeguard. Until we

change the business culture into one that allows cyber security professionals the latitude

to mandate that system baselines are kept, that critical vulnerabilities are remediated

immediately, that unused ports and unused services remain off, that comprehensive logs

are sent to a security tool for analytics,etc. we will continue to have data breaches

reported on pretty much a daily basis. Organizational data breaches are getting to be too

common and too severe to be ignored. Already this year we have seen:

A 56 million card credit card breach at Home Depot
4.5 million patient records compromised at Community Health Services
A breach of over 216 stores at Jimmy John’s
The discovery of a 2-year, 82,600 patient breach out of Aventura Hospital and Medical Center
1.4 million TripAdvisor customers compromised
A Neiman Marcus breach of 350,000 cards
A breach of 868,000 cards from 330 stores at Goodwill

Oh well, at least at the end of the day we can forget about these breaches and unwind

with a few video games. That is, of course, as long as they aren’t one of the games like

Destiny and Call of Duty that hackers DDoS’d with little effort.

The bulleted items above are just the high-profile incidents. Numerous smaller

companies have also been compromised. Yet companies still refuse to believe that this

could happen to them. According to the Ponemon Institute, 43% of companies had a data

breach in the past year. It is time for companies to realize the cyber threat isn’t some

boogieman in the closet; it is a real and increasingly present threat.

These threats come with real consequences. According to a report published

by IBM the average cost of a cyber breach is $201 per record compromised. This

averages out to a cost of $5.9 million per breach with some breaches exceeding

$21 million. The IBM report also suggests that customers and investors are becoming

increasingly less likely to continue doing business with an organization that has had a

breach.

Breaches also come with legal battles. Right now, Home Depot is caught in a

firestorm of suits, one of which is to the tune of $450 million for negligence.

It is a sad state that it appears as if Information Security teams are woefully incapable of

keeping up with the increasingly prominent and advanced cyber threat. This isn’t due to

lack of knowledge or talent but due to lack of influence within their organization. It is too

easy and too common for companies to hire CISOs and large security teams to make

themselves feel safe and then when those teams want to change policies, procedures,

or add security controls they are shunned and ignored due to the inconvenience

associated with securing systems. Or, and this appears to be the non-security business

executive’s number one trump card these CISOs and their teams are told “you just don’t

understand the business”; which really means that the business executive doesn’t

understand or believe the security analysis. Worse is that in most organizations these

Cyber Security teams have no power to mandate appropriate action be taken to secure

organizational systems. When organizational charts put the CISO underneath executive

decision makers, instead of high enough to warrant a chair at “the big kids table,” it is

extremely difficult for security teams to make a meaningful change in their organization’s

security posture. Until security teams are given the authority they need to be effective

these daily breaches will continue.

http://www.theregister.co.uk/2014/09/23/call_of_duty_lizard_squad_ddos/

http://www.latimes.com/business/technology/la-fi-tn-community-health-hacked-20140818-story.html

http://krebsonsecurity.com/2014/09/jimmy-johns-confirms-breach-at-216-stores/

http://krebsonsecurity.com/2014/09/home-depot-56m-cards-impacted-malware-contained/

http://healthitsecurity.com/2014/09/16/aventura-hospital-reports-82601-patients-data-breach/

http://www.cnbc.com/id/102027979#.

http://www.forbes.com/sites/katevinton/2014/09/23/data-breach-bulletin-home-depot-ebay-ck-systems-call-of-duty-destiny/

http://www.bankinfosecurity.com/home-depot-faces-canadian-breach-suit-a-7351

http://www-935.ibm.com/services/us/en/it-services/security-services/cost-of-data-breach/

The Talent Within

11/8/2012

In his book “Topgrading: How leading companies win by hiring, coaching and keeping the best people” (2005) Dr. Smart talks about how important it is for a company to not only hire A level talent but then keep and retain them through the years. I have had the good fortune to work for a company that was very good at this and not only did they hire and retain A players they had a very good internal training program to make sure that the A players they hired were trained and taught the new roles they moved into in order to lessen the knowledge gap and learning curve for the new position. In this environment efficiency, streamlining, being agile, having solid and well followed processes were the norm. Needless to say this is a good environment for a talented knowledge professional to work and grow in. The basic idea was to hire and surround yourself with great and talented A performers and then allow them to make decisions and drive systemic change ongoing. To me this process of hiring smart and talented people and then promoting them as next step openings become available makes a lot of sense.

Unfortunately, throughout my professional travels what I have often observed is that even in companies with great training programs and who espouse the philosophy of growing talent from within there is a strong psychological tendency to seek outside for the next professional with a briefcase (J that’s an old joke about how your own company or organization never views you as an expert or qualified candidate, even if the rest of the nation views you that way), and bypass their internal talent pool.

What a lot of the VPs and directors who are hiring do not realize is that if you have an A player on your staff who is one level lower than the position you are filling they will succeed if you put them in the position, even if they have some knowledge gaps, that is pretty much what A players do. I know, a lot of you who are reading this are scratching your heads and thinking about all the times a resource is promoted beyond their ability and wondering how that fits in. The answer is simple, they weren’t an A player or they were an A player who, inherited all B and C players and wouldn’t aggressively cull the herd.

Both competent B and lower level C performers, especially ones that are non-performing destroy any possibility of creating a high performing team. These lower talented professionals don’t create this less than successful environment on purpose, it is just that they really don’t understand the higher level connections and thought process of the A player and they end up being more of a hindrance and distractor to overall success than they are a key component to the accomplishment of overall success.

There is research study after research study that shows if you have 90+% A players in your management ranks you will be extremely successful in your team and corporate endeavors. That being said I continue to scratch my head when I see organizations with A level talent who are available to move into a next tier open position go out on a public search to fill the position. A level talent is very hard to find, and to think that you are going to be able to search outside and find it more readily than you can identify and find it in the work force that has been with you for an extended period of time is simply naive. What typically happens is that an experienced director or VP is brought in from the outside and they end up after a short amount of time showing that they are a B or low level C talent. Even more mind boggling to me is that none of the people who were responsible for bringing this less than high end performer into the organization want to admit to making a bad hire so they live with the impact an under talented manager brings to their organization. The outcome of such a decision is that their true A players are driven from the organization and they take their talents to a competitor, where they are typically extremely successful working and managing at a level their previous employer would not promote them into.

Organizations really need to take a good look at their talent retention programs and give them more than just lip service and they also need to come to the realization that all forced ranking systems do is allow for the B and C players figure out sly ways to sabotage their talent pool of A players. Like Ken Blanchard says, organizations should help all of their “employees earn a grade of an A”, in my opinion the Blanchard approach to talent management will more readily allow you to identify and distinguish between the A, B and C players in your talent pool.