What rattles around in the mind of your CISO? | Russell Eubanks | WWHF San Diego 2022

### Overview In this presentation at Wild West Hackin' Fest San Diego 2022, Russell Eubanks—former Senior Vice President, CIO, and CISO of the Federal Reserve Bank of Atlanta—shares insights into executive leadership and the mindset of a Chief Information Security Officer. Reflecting on his career journey from working manual labor in a Maytag factory to executive leadership and ultimately starting his own consulting business on March 9, 2020, Eubanks emphasizes the core principle of getting wisdom as cheaply as possible by learning from others. He breaks down the responsibilities rattling around in a CISO's mind into three core leadership dimensions: leading up, leading down, and leading laterally.

### Key Topics - **Leading Up (Speaking the Language of Business):** Eubanks distinguishes between being managed and actively leading up. To communicate effectively with executive leadership, boards, and CFOs, security leaders must translate technical data into business impact. Using Nordstrom's mission statement ("to give customers the most compelling shopping experience possible") as an illustration, he emphasizes that security tasks (e.g., log reviews, policy compliance, incident response) must explicitly tie back to why the organization exists rather than existing for cybersecurity's sake alone. - **Leading Down (Mentoring, Vision, and Strategic Accountability):** Leaders must transition from hands-on technical execution to verbs like leading, motivating, sharing, and succession planning. Eubanks highlights the necessity of grooming successors (sharing his experience mentoring Alan to take over as CISO at the Atlanta Fed) and establishing clear strategic roadmaps. He also stresses identifying "what can only you do" each day, prioritizing high-leverage responsibilities that unblock teams. - **Leading Laterally (Peer Alignment and Actionable Security):** Working across the organization with non-technical peers (such as financial or facilities leaders) requires making cybersecurity relevant without overwhelming them. Rather than relying on vague platitudes like "cyber is everyone's job," leaders should give colleagues clear, simple calls to action (e.g., specific channels to report anomalies). Furthermore, security leaders must balance their calendar time between internal security team operations and peer engagement across the wider organization.

### Technical Details - **Detecting Authorized vs. Unauthorized Change:** Eubanks introduces a framing question for technical stakeholders: *"How long can you stand to not know?"* For example, asking network administrators how long they can tolerate not knowing when a production firewall running configuration has changed (e.g., 5 minutes), or asking Windows administrators when an account is added to Domain Admins. Security operations can then implement configuration monitoring and log analysis tied into change management systems to differentiate authorized ticketed maintenance windows from unapproved changes. - **CISO Mind Map:** Attribution is given to Rafeeq's CISO Mind Map as a structured reference categorizing executive security responsibilities, spanning business alignment, budget, governance, policy, and strategic planning.

### Takeaways - Align daily cybersecurity tasks directly with organizational mission statements so business executives understand funding and operational value. - Security leaders should hold themselves accountable daily to high-impact tasks that only they can accomplish, such as board briefings, succession planning, and resource approvals. - Help peer leaders and employees take security with them by providing actionable, singular reporting instructions rather than generic slogans. - Maintain an intentional balance on the calendar between internal departmental support and cross-functional organizational relationship-building.