From Triage to Transformation

A behind-the-scenes look at the restructuring of the CISO role as part of a dynamic tech modernization effort at the City of Phoenix

As the CISO role evolves in the cybersecurity discipline, organizations of all kinds are being pressed to reconsider what they want from their CISO and their place within the organization. And, in every enterprise, aligning the needs and goals of the business with those of the cybersecurity group is becoming a critical focus.

The City of Phoenix is one such enterprise. The fifth largest city in the nation is reshaping their approach to cybersecurity as part of their mandate to provide secure, responsible, sustainable, and flexible IT services, solutions, and governance. At present, the city has 35 departments, four of which are critical infrastructure: public safety, aviation, elections, and facilities.

Shannon Lawson

When Shannon Lawson became CISO in 2019, the city was doing its absolute best to maintain cybersecurity. Lawson, a Navy veteran, had held information security leadership roles in the military and intelligence community and in state and local governments. Despite the municipality’s best efforts, its information security team was in need of a great deal of strategic and tactical help – and Lawson’s expertise fit the bill.

“The security architecture and engineering team functioned as a single team with two kinds of people,” he explained. Typically, security engineers deploy and maintain the security tools and the architecture team works towards a specific goal of ensuring the system or network is securely designed. That was the case for the city, but Lawson found the implementation to be disjointed as there was no security architecture team. “Just to be clear, these guys were trying to stop the bleed, if you will, and applying tourniquets all over the place.”

The network security team existed primarily to meet Payment Card Industry Data Security Standard (PCI DSS) compliance requirements and ensure basic security services like VPN, firewalls, and web security were maintained. “It wasn’t really driven because there was a comprehensive vision for security,” he said. “We had a lot of tool sets covering a wide stack of different things that were never looked at holistically.”

Lawson promptly began to acquire additional best-in-class tools while building his talent bench. “It was me plus two or three folks that weren’t really security people,” he revealed. “They retired and I built up the team of about 30 people. We now have dedicated branches for specific mission sets. Then we started working on all of our tactics, techniques, and procedures.”

The City’s gatekeepers of cybersecurity policies, standards, and standard operating procedures (SOPs) were the Cyber Strategy and Planning branch, which also is running the city’s Security Awareness Training program. Lawson discovered that most of those policies hadn’t been updated since 2009, if they existed at all. “People were doing their best. They’d never really done it before, so they made their best attempt. As a result, their policies were pages and pages long.”

In addition to being challenged by bloated or nonexistent documentation, a vexing issue was a fundamental misunderstanding of the difference between a policy, a standard, and an SOP, and how each related to the organization’s existing administrative regulations (ARs).

Policies should stand the test of time and rarely change, and the specific technology is generally not included in them. Standards state the “what” and is the practical application of a policy, such as mandating a specific endpoint detection and response technology, like CrowdStrike, on all endpoints. An SOP answers the “how” and is linked to the products and systems that satisfy those standards, which change depending on the circumstances and will need adjustments as software products, dashboards, and widgets change.

“From an information security framework perspective, we follow NIST SP 800-53 and the Center for Internet Security Critical Controls,” he stressed. “Every time we write a policy, a standard, and an SOP, all of those get mapped to the various controls.”

Another key implementation was the establishment of a hybrid Security Operations Center (SOC), integrating an in-house SOC with a Managed Security Service Provider to achieve optimal security outcomes. “Now, the City has a team diligently detects, triages, alerts, and responds to incidents 24x7x365. They have been incredibly busy.”

Risk assessment was another gap. The City’s risk and compliance group had been focused on PCI, but not cyber risks, and the enterprise risk group were not versed in cyber risk. Lawson closed the gap by integrating both teams and bringing expertise to both sides.

Attracting the cream of the crop with bountiful salaries poses difficulties for even large cities when it comes to IT and cybersecurity. City government IT operations generally can’t compete with the coffers of private corporations. Additionally, the cost of software and other tools can be cost-prohibitive. “That’s why you see a lot of municipalities succumbing to ransomware infections,” Lawson said. “You have to bridge people and those tools together by building out the processes.”

The CISO and his team created the City’s first information security library. The first step was building a policy map showing the ownership of policies and standards. “We did several rounds to try to get through where we needed to be,” he said.

Organizational structure is also key, especially given the new SEC cyber reporting requirements as well as the increased frequency of ransomware and other cyber attacks. The CISO should be closely connected to organizational leadership in order to clearly articulate the risks, vulnerabilities, and legal liabilities that the organization may face. The CISO is in a unique position to do this as they should be the trusted security advisor to senior leadership. Communication single threaded and filtered in both directions through one person can be fraught with risk. Perhaps the true severity is not understood or conveyed properly. Maybe the message is getting lost in translation. Either way, the CISO position should be well defined, and the organizational structure should reflect what the organization wants from its CISO. Mutual respect goes a long way to making these complicated relationships work.

While Lawson and his team have accomplished much in the last five years, there is still a lot of work to be done. The Information Security Office is fortunate to have the support of the City Manager the Mayor. “Without the strong advocacy of the Mayor and City Manager, we would not have been able to put the City in a much better security posture.

“The CISO can do very specific things and should have broad access even if they’re not administratively reporting to the head of the organization.”