The Infrastructure-First CISO.
Why the best security leaders obsess over plumbing, not paperwork.
Dean Kastelic
Principal Consultant
The best CISOs focus primarily on infrastructure. They understand that most of the critical preventative controls required for a strong security posture are built on solid infrastructure.
Preventative technical controls are your first line of defence. The second line, GRC, helps ensure correct implementation, but they are not as critical. Yet, many security programs over-emphasise the second line, neglecting the foundation.
“This results in an unbalanced security program—heavy on oversight but light on effective controls.”
The “Paperweight” Problem
It is akin to an OH&S program that is heavy on robust safety checks but only records the lack of essential safeguards—such as guards on cutting machines or emergency stop switches—into the risk register, without taking any actionable steps to fix the problem.
The Requirement: Infrastructure Fluency
To take actionable steps requires an up-to-date understanding of what good infrastructure looks like. It requires recognising how the way we work is changing, how technology is evolving, and how organizations are responding to these changes amid cost pressures.
Doing so highlights the extent the modern workspace demands a secure cloud-native infrastructure to accommodate a workforce that is becoming increasingly mobile and always connected.
The Futuristic CISO Vision
An infrastructure-aware CISO has a futuristic understanding and designs security to support that vision. This means architecting for:
-
☁️
Cloud-native environments: Moving away from legacy on-prem dependencies.
-
📱
Hybrid/Mobile workplaces: Securing users wherever they are.
-
🔒
Zero Trust principles: Never trust, always verify.
The Shift to Cloud-Native Workspace
While OT networks and mainframes may remain on-premises, the workspace is changing. End-user computing and business applications will increasingly become cloud-native.
Actionable Steps for Leaders
We need to be prepared for the changes underway by ensuring security is secure by design. This requires working closely with the CIO to migrate:
By influencing a secure-by-design infrastructure, we greatly improve our overall security posture by narrowing the attack surface. In turn, this makes GRC and detect and response functions easier and more effective.
A Note to Practitioners
I know most of you are well aware of the importance of solid infrastructure. This message is for those who are swamped with satisfying audits and have become lost in compliance frameworks.
My intention is not to suggest that you don’t know this, but to remind you of the importance of balancing compliance with practical, infrastructure-focused security measures.
The Bottom Line
“Without a solid foundation, GRC becomes a box-ticking exercise, and SOCs drown in alerts from an inherently insecure environment.”
Build a Solid Foundation
Is your program heavy on oversight but light on controls? Let’s fix the balance.