The 10 critical characteristics of a national cyber coordinator

It can be argued that leaders are transportable. That is to say, some people possess leadership characteristics that can be leveraged successfully in any organization. A CEO of a high-tech company can probably also effectively lead an automobile manufacturing business, retail clothing outlet, professional football team or neighborhood deli. On the other hand, it can also be argued that a specific knowledge base must be required of leadership. The skills that enable a leader to be successful in directing a Hollywood production are different from the skills and characteristics required to run a hedge fund on Wall Street or a casino in Las Vegas.

Assuming that the latter leadership philosophy might best apply to the information security industry, let’s consider what characteristics of leadership are necessary to coordinate the nation’s cybersecurity policies and programs. The (ISC)² U.S. Government Advisory Board Writers Bureau polled a team of U.S. government cybersecurity leaders, chief information security officers and other seasoned federal government professionals in order to develop a list of critical characteristics that will be required of the new cybersecurity “czar” in order for him/her to succeed. This is particularly timely as the White House prepares to name a U.S. cybersecurity coordinator who will direct the nation’s cybersecurity program.

Make no mistake; this will be a very difficult job, much like that of the Y2K coordinator or the individual who led the European nations through the transition of currency to the euro. The problems will outweigh the solutions and the frustrations will overwhelm the successes. Nonetheless, this individual will have the honor of executing one of the most important missions of the federal government, which is to protect our nation’s information and information infrastructure from those who wish to do our country harm.

The following list identifies the characteristics that government leaders would like to see in the person who steps into this very important role.

1. Leadership skills on loan from Winston Churchill and Franklin Roosevelt

We are at war in the cybersecurity arena and some would assert that we have lost many battles to date. Our nation needs a wartime leader to turn the tide on the cybersecurity war. This individual’s leadership qualities must instill confidence, focus disjointed efforts, negotiate for resources and bring together competing prerogatives, all for the common goal of protecting our nation’s critical information and infrastructure. The mission is urgent, monumental and highly complex, and failure is not an option. The required leadership skills are a combination of intelligence, optimism, confidence and charisma, all of which are necessary to persuade a universal public-private partnership to improve their efforts to secure our nation.

2. Problem-solving skills on loan from Albert Einstein

If you want a difficult problem to solve, try protecting the most precious information resources and assets -- the lifeblood of one of the most powerful nations in the world -- from an adversary that is invisible, well-resourced, highly technical, extremely skilled, agile, ruthless and several steps ahead of our defenses. Take this same problem and drop it inside an intractable bureaucracy with political minefields, turf issues and organizational prerogatives. Stir in congressional oversight with a dump truck full of powerful lobbying. Divide by a couple of dozen departments and agencies with their own cultures and their own way of doing things. Now, that’s a problem that requires considerable skills to solve.

3. Vision

This characteristic may be the most challenging one for the cyber coordinator because tomorrow’s hackers, spies, criminals, international thieves and hostile governments will not be attacking today’s infrastructures. They will be attacking a combination of current and future infrastructures. So, vision is required in four areas:

1. A knowledge of current infrastructure and its limitations knowing it will take considerable time to be replaced.
2. What future technological infrastructure and vulnerabilities will look like.
3. How future threats will be executed.
4. What controls, safeguards, countermeasures and decisions must be implemented to counter what will/may occur.

Given that the technology infrastructure in five years will look quite different from today, the coordinator must put a high priority on research and technology forecasting as part of federal information system initiatives.

4. Diplomat on the outside and pit bull on the inside

The individual selected for this position must project a very diplomatic image, being both approachable and charismatic. On the inside, he/she must be tough, pick his or her fights very selectively and be ready, willing and able to fight for the right outcome. This is a war in which security outcomes cannot be marginalized by the indecision of committees or the quicksand of bureaucracy. The cyber coordinator must have a nose for politics and be able to make peace and wage war swiftly, decisively and concurrently (albeit selectively and deftly).

5. Self-confidence with an absence of ego and ambition

Security is hard to measure. Unlike other areas in a typical business that are easy to measure, the success of a security program is measured by the bad things that don’t happen. Security achievement, at its best, is transparent. A cyber coordinator must have a strong sense of confidence that what he or she is doing is the right thing, in the face of criticism and resistance, without necessarily being able to broadcast demonstrable successes. An individual in need of the limelight and of continuous self-promotion would probably not be the best choice for this position. The individual selected for this position must be humbled by its magnitude and honored to be selected for such a critical challenge.

6. A podium presence on loan from Ronald Reagan

Notwithstanding the aforementioned humility required for this position, the individual selected must be a first-class communicator. Whether he or she is in front of the most senior federal decision makers, the American public or simply talking to his/her own team, the cyber coordinator must communicate with confidence, skill, precision, substance and, when appropriate, humor. On those occasions when things go wrong, a cyber coordinator must be equipped with knowledge, resiliency, level-headedness and be able to articulate eloquence to manage the tough questions that will be posed by a relentless media.

7. Able to leap tall buildings

This individual will have one of the most important missions in the federal government. It will require coordination across disparate federal departments and agencies, across the vastness of the Defense Department and intelligence communities and throughout the private commercial industry — a vast community whose products and services support the critical infrastructures that our nation relies upon for its security and commerce. Rallying all of these forces to a common action and purpose will be a daunting feat of mass proportions, a superhuman task. A cape should be issued on the first day of the job.

8. Depth of knowledge and wisdom through life experiences

Although the cyber coordinator will not be pulling cable, writing code, debugging firewall rules or reading audit files, he or she must be able to ask the probing questions, know if the answers make sense, support funding for the right initiatives and generally understand the rapidly-changing landscape of information security capabilities and solutions. He or she should not think of “virtual worlds” as dreams, or that “clouds” signal a storm or that a “switch” should be replaced by a dimmer. The person selected should be well grounded in information technology and understand the business ramifications of inadequate security and how to best approach implementation of an appropriate level of security to carry out the mission. He or she must also understand that the mistakes of the past should not be repeated in the future. Most importantly, he/she must have wisdom “to know what they don’t know” and an understanding of how to surround themselves with experts who share their goals, vision and sense of urgency.

9. An unbreakable spirit and fearless determination

The cyber coordinator will be loved and respected by few, tolerated by most, feared by some and opposed by many. In the face of immense bureaucratic and political obstacles, complex challenges and opposing factions, the coordinator must be deaf to baseless criticism, unflinching in the face of controversy and relentlessly focused on the right outcomes. Thin-skinned individuals need not apply. The mission is to secure our nation’s systems, networks, information and infrastructures. That mission must be accomplished regardless of the inevitable resistance.

10. Impeccable integrity

Although integrity is critical for any leader, the coordinator of our nation’s cybersecurity program must have an extremely high degree of personal and professional integrity, character and trust-worthiness. He or she must have an impeccable record regarding past behaviors and attitudes, current actions and future decisions. The positions advocated by the individual in this important position must be free from actual or perceived influence or coercion and must be governed by an honest and unfettered view of cyber space.

The new national coordinator for cybersecurity may need additional characteristics and qualifications, but if in possession of all 10 traits described here, he/she will assume this position of leadership well-prepared to successfully defend the nation’s systems and critical infrastructures against a multitude of adversaries operating in cyberspace.