Day: February 3, 2017

Posted on

How to Win the IT Advisory Talent Battle

Demand never has been higher for the IT advisory skill set. At our firm, we’re seeing more competition now than even existed in the SOX boom of the mid-2000s. Positions across the United States are re-maining open for months at a time. Your company wants to make sure it’s not settling on the first ap-plicant who knows the difference between CISA and COBIT and, instead, wants to attract the brightest talent that will really make a difference to your team.

We’ve seen some common themes among our clients who consistently attract the best candidates, and I’d like to share them with you so that you can win the talent war in 2017 and beyond.

Impact
The number one motivation for making a job change that I hear time and time again goes something like this: “I don’t feel like my position really makes a difference. I just check up on everyone else.” You need to make sure you’re marketing your position as one that allows the applicant to see the meaning and purpose of his or her work. Tell them success stories about your department and paint a picture for them about how you are perceived in the organization.

A recent example from one of our clients was a project where the business operations and IT security teams could not agree on the best way to move forward on a large product rollout. The IT audit team (through years of showing its value to the business) was instrumental in making sure both sides came to an agreement in order to release a workable product. Not only does this IT audit team now have the pride and satisfaction from helping shape one of the company’s most important initiatives, but is has also turned into a great recruiting story allowing them to attract top talent. That’s true impact.

Work/life balance
The rise of the Silicon Valley style corporations with unlimited vacation time, a whole year for paterni-ty/maternity leave and game tables in every conference room has made it difficult to win the talent war without offering an appealing work/life balance. At the management level, I know you’re not able to change large policies like I’ve mentioned above, but what you can do is make your department one that embraces technological advances that allows your employees to work when they can, where they can.

I realize that this is more easily said than done, but companies that are doing this are able to attract the best talent. Perks such as working a day a week from home, flexible work schedules (get in early/leave early, etc.,) and making sure on-site time is used to maximize face-to-face encounters with internal customers and team members while the rest of the work is done from a coffee shop, etc., will help you to be much more appealing to the generation that has grown up with information available any-where, on any platform.

Growth
Obviously, your goal is to retain the talent you are able to attract. The best way to do that is to make sure your employees are challenged, able to grow and never bored: “I want to make sure I’m not a (insert job title here) forever.”

It’s a common concern among candidates I speak with and human nature to not want to feel trapped. Candidates want to feel there is a career path for them and know that they won’t be doing the same thing every day. They crave variety, challenge, growth and advancement. If you plan to hire someone who already knows how to do everything in your job description, you’re setting yourself up to have someone leave your department early if there is no significant growth or challenge for them if they stay. In so far as possible, create opportunities for your employees to add to their skill sets, and enable them to advance within and eventually beyond your department. If you don’t have a compelling story about the growth opportunities you can provide for your new team members, you will continue to lose that talent to other companies who can show them a challenging career path.

Use what sets you apart
If you search for the term “CISA” on LinkedIn, Indeed, Monster and CareerBuilder, you’ll find thou-sands of available roles. On ISACA’s own job board, there are 500. With competition like that, you need to be sure your company and opportunity stands out from the rest.

What is special about your company that attracted you to work there? How do you address mentoring younger talent? What processes do you have in place to groom the candidate for future leadership roles? Also, make sure to allow the applicant to go to lunch with potential co-workers, not just manag-ers. Applicants who leave the interview believing they will enjoy working beside the people they meet will be much more inclined to want to work for you.

Highlighting smaller perks doesn’t hurt, either. Do you have a generous 401K match? Does your com-pany offer free lunches in the cafeteria? Have an onsite daycare? Make sure you advertise those.

My goal for this article was to provide value to you and help you identify some things you can do to attract the talent you need to succeed. If I can answer any questions to help you win the talent battle, write your questions in the comments below!

Brad Owens, Recruiting Director, Duval Search

[ISACA Now Blog]

Posted on

Build Your (ISC)² Network through Chapters in EMEA and North America

Are you looking to start an (ISC)² Chapter in your area? The enrollment period for chapters in the Europe, Middle East and Africa (EMEA) and North America regions is now open through February 5. Through the chapter program, (ISC)² members and other information security professionals further advance the organization’s vision to inspire a safe and secure cyber world by sharing knowledge, raising security awareness and advancing information security in local communities around the world.

To be eligible to start a chapter, you will need to meet the following requirements:

  • Be an (ISC)² member in good standing for a minimum of three years.
  • Be a resident of the area in which you plan to start a chapter for at least one year.
  • Have proven leadership experience in a professional setting.
  • Not currently serving as an officer of another security chapter organization.
  • No previous convictions of criminal activity or conduct.

Since lifting the moratorium on chapters this month, we have already received several applications from the two regions, and we look forward to receiving more! The new chapter application process is streamlined and entirely online, making it easier to get started.

To submit a chapter application, visit https://isc2chapters.communityforce.com/

Open enrollment for the Asia-Pacific (APAC) and Latin America (LATAM) region chapters will begin in Q2 2017. Keep an eye on our blog for an announcement.

[(ISC)² Blog]

Posted on

Exploit Kits: Protect Yourself Before You Wreck Yourself

Exploit kits have become go-to tools for attackers to take control of victims’ machines or steal information. To protect yourself from this type of attack, it’s important to understand how exploit kits work, what their process is, and what vulnerable parts of your organization they are targeting. Our brief, Exploit Kits: A Series of Unfortunate Events, breaks down the sequence of events an exploit kit must complete to successfully execute an attack.

Most endpoint security solutions use signatures to prevent known threats that have already successfully penetrated networks. But attackers of varying skillsets can bypass signatures using inexpensive, automated tools that produce countless unique and unknown attacks.

Palo Alto Networks Traps advanced endpoint protection provides multi-method exploit prevention by focusing on the core exploitation techniques used in exploit attacks, rather than relying on signatures to prevent already-known threats. The result is several layers of protection to block known, unknown and zero-day threats before they compromise an endpoint.

Traps recognizes and proactively blocks exploit techniques that:

  • Manipulate the operating system’s normal memory management mechanism for applications used to open up compromised data files
  • Would allow an exploit to manipulate an operating system’s normal application process and execution mechanisms
  • Would allow malicious code embedded in an exploit file to execute

Traps integration with Palo Alto Networks WildFire, our cloud-based threat intelligence service, provides further protection by preventing known malware execution and uploading unknown malware for dynamic analysis and rendering a verdict within five minutes. Once malware is known, it can be prevented at the network by Palo Alto Networks Next-Generation Firewalls or on any endpoint running a Traps agent.

Organizations that use Traps can continue to use applications, including those built in-house, legacy systems, and software running on unsupported operating systems for example Windows XP or Windows Server 2003.

Learn more about how Traps prevents malware and exploits.

[Palo Alto Networks Research Center]

Posted on

Is Your Security Team Ready For Cloud?

A version of the following article originally appeared in Dark Reading.

By now, most of us in IT are well aware of the technical and business advantages that moving to a cloud-based data center provides. But there is still a lingering hesitancy among some organizations considering a move to the cloud.

In my experience, most concerns boil down to two factors: a reluctance to put trusted data on a network that’s not on the premises, and confusion around the costs and complexity of moving to the cloud. If that’s what’s keeping an organization from the cloud, I have a few points to share that should help them clear up the “cloudiness” (pun intended) and shine light on the possibilities.

When It Comes To Security, The Cloud Is Ready
If there is one roadblock that keeps IT teams leery about the cloud, it’s cybersecurity. And while cybersecurity will always be a concern, when it comes to the cloud, the industry is well-prepared. Leading public cloud providers, like Amazon AWS and Microsoft Azure, have made significant investments in securing their cloud environments and both companies offer robust security resources to cloud customers via the Microsoft Azure Trust Center or Amazon’s AWS Cloud Security.

Cloud providers are also building an expansive ecosystem of security technology partners who can provide cybersecurity solutions for the public cloud and Software-as-a-Service. These solutions, if implemented as a cohesive platform and not an ad hoc collection of security devices that don’t work well together, can provide a consistent and seamless security experience to both cloud-based and physical networks through consistent visibility, policy, and enforcement across the network regardless of a user’s location. Another plus is the Cloud Security Alliance, an industry consortium of companies that provides excellent resources to help cloud adopters address security concerns and stay up to date on the latest developments in cloud technology.

Are You Ready for the Cloud? Read Frank’s full article at Dark Reading.

[Palo Alto Networks Research Center]

English
English
Exit mobile version