Leadership and Security Michael Sardaryzadeh Ph D Chief

Leadership and Security Michael Sardaryzadeh, Ph. D. Chief Information Security Officer, Texas A&M University

A Look at Leadership History

Scientific Management Frederick Winslow Taylor, early 20 th century • Maximized efficiency by timing the production process • Believed that leaders were born, not made • Assumed there was only one form of effective leadership

Great Man and Trait Theory • Early 20 th century • Certain men are born to lead • Natural leaders step up in times of crisis

10 best traits and skills of effective leaders (R. M. Stogdill, 1974) 1. Drive for responsibility and task completion 2. Vigor and persistence in pursuit of goals 3. Venturesomeness and originality in problem-solving 4. Drive to exercise initiative in social situations 5. self-confidence and sense of personal identity 6. Willingness to accept consequences of decision and action 7. Readiness to absorb interpersonal stress 8. Willingness to tolerate frustration and delay 9. Ability to influence other persons' behavior 10. Capacity to structure social interaction systems to the purpose at hand

Three Leadership Types in Organizations (Lewin, Lippett, White) 1. Autocratic leadership • The corporate leader made all decisions without consultation. 2. Democratic leadership • The leader-supervisors included members of the organization in the decision-making process. 3. Laissez Faire leadership • The leader played a minimal role in the decision-making process.

Charismatic Authority Max Weber • “A special personality characteristic that gives a person…exceptional powers that result in the person being treated as a leader. ” • Personal characteristics of charismatic leader Dominant o Strong desire to influence others o Self-confident o Strong sense of one’s own moral values o

Contingency Theory of Leadership Fred Fiedler • There is one best style of leadership and that style fit all situations • Came to believe that the best leadership style was the one that best fit a given situation

Leader-Member Exchange Theory (LMX) • Discussed extensively by a number of organizational behavioral scientists o including Dansereau, Graen, and Haga, • Based on social exchange theory • Focuses the quality of relationships and interactions between leaders and followers

Situational Leadership Dr. Paul Hersey and Dr. Ken Blanchard • Leaders choose the leadership style based on the maturity or developmental level of the follower. • A four quadrant configuration based on the relevant amounts of directive and or supportive needed to motivate a given employee to fulfill a given task. • Leadership styles based on the situation: 1. 2. 3. 4. Directing Coaching Supporting Delegating

Hersey’s Situational Leadership Model

Leadership Today

Servant Leadership • Robert Greenleaf (1970 and 1977) • Leadership focused on the follower • Greenleaf's ideas didn’t catch on until the 1990 s

10 proposed characteristics of servant leaders (Spears, 1990 s) 1. Listening 2. Empathy 3. Healing 4. Awareness 5. Persuasion 6. Conceptualization 7. Foresight 8. Stewardship 9. Commitment to the growth of the people 10. Building community

Transformational Leadership • Widely researched from the 1980 s to 2011 • James Mc. Gregor Burns and Bernard Bass • Definition: o An individual engages with others and creates a connection that raises the level of motivation and morality in both the leader and the followers

How to motivate followers to do more than expected (Bass, 1985) • Raise followers' level of consciousness about the importance of organizational values and goals • Get followers to transcend their own self-interest for the sake of the team or organization • Move followers to address higher-level needs

Four Concepts of Transformational Leadership (Bass, 1985) 1. Idealized Influence • The leader-supervisor acts like a role model of ethical behavior and gains respect and trust. 2. Inspirational Motivation • The leader communicates high expectations and inspires the crew to reach higher. 3. Intellectual Stimulation • The follower-subordinates are stimulated to think outside the box, be creative and innovative. 4. Individualized Consideration • The subordinates are provided a supportive environment and the leader cares about each employee's needs and desires.

Authentic Leadership • One of the newest proposed leadership styles • Dr. Bruce Avolio and Fred Luthans • Authentic Leadership Questionnaire definition: o Authentic Leadership a pattern of leader behavior that draws upon and promotes both positive psychological capacities and a positive ethical climate, to foster great self-awareness, an internalized moral perspective, balanced processing of information, and relational transparency on part of leaders working with followers, fostering self-development. o (2008, Walumbwa, Avolio, et al. )

Level 4 Causes Global Change Level 3 Causes National/Industry Change Level 2 Causes Organizational Change Level 1 Causes Individual Change Forced Change Path Causation Path The MS 12 Model

Cybersecurity

Introduction to Cybersecurity Cyber Academic I. T. Medicine Academic Experience Resident

Introduction to Cybersecurity Medicine General Gynecology Pediatrics Etc. . surgeon etc. . Security/Risk Management Vulnerability Management e. GRC Net. Sec Pentesting Application etc. . Etc. .

Recipe to Leading a Security Team

Main Ingredient • The best talent for the money

Necessary Ingredients • Autonomy Our desire to be self directed o Increases engagement over compliance o • Mastery o The urge to get better skills • Purpose The desire to do something that has meaning and is important o Businesses that only focus on profits without valuing purpose will end up with poor customer service and unhappy employees o

Also Need • Be able to tell a story • Technical • Motivational • Flexible • Emotional Intelligence • Confident Leader

Secret to Guaranteed Failure • No money • No board support

Moving Forward

Measurement and Management • What gets measured gets managed • Any metric should answer these 3 questions: o Where are we? o Where do we want to be? o How do we get there? • Cadence and Review

Where we go from here at TAMU Strategy Framework NIST CSF 2018 2019 2020 Proactive Approach Maturity Partial Informed Adaptive/Automated Repeatable Identify ü Gaining the institutional understanding to identify what systems need to be protected, assess priority in light of organizational mission, and manage processes to achieve cost effective risk management goals Business Continuity Plan Evaluate Current State HIPAA Security Program Matured / Semi-automated Auditing cycle and Process - Know Our Assets & Risk Protect ü Appropriate outcome-based actions to ensure adequate protection against threats to business systems that support critical infrastructure components. - Protect Against Loss >70% Security Coverage >80% Security Visibility >85% Security Coverage >90% Security Visibility Maximum & Sustained Security Visibility & Coverage Reactive Approach Detect ü Activities that identify (through ongoing monitoring or other means of observation) the presence of undesirable cyber risk events, and the processes to assess the potential impact of those events. Maximize Sources & Improve correlations Audit Current Sources MPP & Data Science - Find the Threats & Vulnerabilities Respond & Recover ü Develop and implement the appropriate activities to take action regarding and against a detected cyber security event Minimal Detection Normal Threat Detection Advanced Threat Detection - Hunt and Expel bad actors ü Develop and implement the appropriate activities for resilience and to restore any capabilities or services that were impaired - Get back to Normal State Audit Response and Recovery capabilities (Measure) Improve Audit Response and Recovery capabilities (Measure ) Audit Response and Recovery capabilities (Measure) Improve

Questions?