Robert E. Wiley Jr.

I agree with Roberto Ishmael Pennino. Transparency is key to adopting a new process or protocol. But how do you create that transparency? Several studies intimate that buy-in to the new process or protocol is essential with anywhere from 50% - 90% buy-in as a critical mass from the employees is needed for successful adoption. With this transparency or buy-in there are four areas that should be included to enhance the adoption: 1. Communication and training - "the why" 2. Involvement and planning - employees help with decision making. 3. Pilot testing - phased introduction to refine the process. 4. Feedback - provide opportunity for the decision-makers to address concerns will improve acceptance rates.

Align with organizational goals by understanding the business needs. Begin by understanding the organization's overall business objectives. Align your cybersecurity goals with these needs, ensuring the team’s efforts directly support the organization’s mission and risk tolerance. Also, use a risk-based approach by setting objectives from key risks the organization faces (e.g., data protection, regulatory compliance, operational resilience). Using the SMART framework will help define specific and measurable goals or metrics. Also, maximizing clarified roles and responsibilities will minimize any nuance friction or hurdles that pop up from remote positions.

There are bubbles of learning that directly enhance growth in the current position. For example, if you are a SOC analyst, look for opportunities to expand your current role. If there are none available, pursue certifications such as the Certified SOC Analyst or the GIAC certified incident handler. If you are maxed on those try your hand at HTB, THM, TCM paths. And if those are maxed out take on traditional classes from colleges or universities. There are other outlets that offer education such as Cybrary, Coursera, and Udemy. Examples above are offered for a wide variety of segments within cybersecurity: GRC, Pen Testing, Blue Teaming, Red Teaming, Purple Teaming, Cyber Hygiene, Awareness Training, Splunk, Palo Alto, HP, and Microsoft.

How can an organization evaluate the severity of potential threats and the likelihood of occurrence? First, identify all of the threats then assess the impact from a financial, operational, reputational, and safety lens. The likelihood should be based on historical data, expert judgment, statistics of that threat, and any environmental factors (qualitative and quantitative assessments). Place this data in a matrix: Likelihood/impact Low Medium High Critical Very Likely Likely Possible Unlikely Develop strategies to mitigate those risks by preventative controls, contingency plans, transfer of risk, or accept the risk based on the organization's tolerance.

Clarity is the counter to ambiguity and procrastination. What are some examples of clarity? Provide realistic beginning and ending set times and dates versus, "ASAP." Provide the team with update meetings to ensure movement on the project and as a resource for removing obstacles. Involve team members by explaining where their time or product fits into the larger picture (enables ownership). Also, align the task with the organization's strategy or goals. Explain how the project will be tracked. Use Teams or Jira and use multiple communication channels necessary to encourage open channels between team members. The last item is to provide resources and support that will help team members reach each milestone in the project.

What are some ways an individual can upskill within the Information Security career? A person can attend webinars and conferences, or podcasts such as Darknet Diaries, SimplyCyber, or Cyber View. Also, obtain relative certs as well as attend conferences (Def Con, Cactus Con, Black Hat, or RSA. Another way to upskill is to take advanced courses or specializations such as Digital Forensics from Coursera or Udemy. Staying up-to-date on emerging technologies such as 6G, 7G, or the latest speed demon of fiber optics transferring data at 1.7 petabits of data (crazy), or the up-and-coming quantum computing. Last but not least always develop soft skills by aligning them with your learning plan.