S02E10 From Firefighting to Strategy - Jason Brown
This episode of the Blue Dragon podcast features Jason Brown, a seasoned cybersecurity leader, former CISO/vCISO, and author, discussing his book, "Unveiling NIST Cybersecurity Framework 2.0". The conversation centers on the NIST CSF 2.0, emphasizing the critical addition of the "Govern" function. Jason frames the CSF as an excellent introductory framework for building a cybersecurity program, often used in conjunction with the Center for Internet Security (CIS) controls. A key theme is moving cybersecurity beyond a technical "IT problem" and a "checkbox exercise" to a strategic business value driver that builds trust and unlocks revenue. Both speakers highlight the growing global focus on supply chain security (NIST CSF, NIS2, DORA) and the rising personal liability and accountability for CISOs and executives in the US and Europe. The discussion concludes with a deep dive into the importance of a well-structured three-layered documentation approach (Policy, Standard, and Procedure) and a formalized document lifecycle to maintain organizational security maturity.
LINKS
➰ https://bluedragonpodcast.com
➰ linkedin.com/in/jasonbrown17
➰ jason@jasonbrown.us
➰ https://jasonbrown.us
➰ Book: bit.ly/Unveiling-NIST
CHAPTERS
(00:00:00) 00:00:00 Introduction (Guest: Jason Brown, Author)
(00:03:39) Guest Background & Path to Writing NIST CSF 2.0 Book
(00:05:20) Core of NIST CSF 2.0: The addition of the 'Govern' function
(00:06:34) Primary Driver for CSF 2.0: Supply Chain Governance
(00:08:05) CSF's Role: An introductory framework, often paired with CIS Controls
(00:09:21) Security as a Value Driver: Moving past compliance for revenue and trust
(00:11:48) CISO's Role: Building relationships for program and financial support
(00:14:00) Common Mistakes: Failing to assess gaps or focus on the 'how'
(00:15:48) Overview of the Six CSF Functions (Govern, Identify, Protect, Detect, Respond, Recover)
(00:17:43) Prioritizing Governance: It is the hardest step due to changing people
(00:19:32) Overcoming Governance Hurdles: Dialogue with Executive Leadership Teams (ELT)
(00:21:20) Executive Accountability: Personal liability and fines (US SEC, EU NIS2)
(00:25:54) Communicating Value: Use Enterprise Risk instead of technical jargon
(00:27:53) Security as a Business Problem: Not just an IT problem (Jaguar example)
(00:30:41) Engaging Leaders: Involving department heads in identifying critical assets (ID.BE)
(00:32:19) Future CSF Evolution: Expected integration of AI and emerging technologies
(00:33:36) Three-Layered Documentation: Policy (what), Standard (guidelines), Procedure (how-to)
(00:37:05) The Open Policy Framework: Jason's structured documentation approach
(00:38:02) Document Lifecycle: Annual review prevents reliance on outdated, breakable standards
(00:40:04) Personal Updates: Break from writing for family time
(00:40:29) Automotive Industry Security: Brief mention of OT concerns
KEYPOINTS
1. NIST CSF 2.0's "Govern" function is key for a complete cyber program; it is the most critical starting point due to the challenge of changing people.
2. Cybersecurity must be framed as a business value driver and revenue generator, moving past a simple compliance checklist mentality.
3. The CISO's role is strategic: acting as a business enabler by communicating security needs via enterprise risk to the ELT.
4. Global regulations (NIS2, SEC) are increasing personal liability for executives, making robust governance mandatory, not optional.
5. A strong governance structure uses three distinct layers: Policy (public commitment), Standard (confidential guidelines), and Procedure (technical configuration).
6. Security documents must have a formal lifecycle with annual reviews to ensure standards remain current and effective against threats.
