--- title: Risk and Reward – the Importance of Knowing the Network description: "New or legacy, CISO's deal with a range of evolving variables, though one stands out as the essential bedrock of their platform: their understanding of the network they defend." image: https://blog.nisos.com/hubfs/Screen%20Shot%202020-04-22%20at%209.56.48%20AM.png --- [![NISOS\_logo\_high\_res\_horiz-black](https://blog.nisos.com/hs-fs/hubfs/NISOS_logo_high_res_horiz-black.png?width=3357&height=674&name=NISOS_logo_high_res_horiz-black.png "NISOS_logo_high_res_horiz-black")](https://www.nisos.com/) - [Home](https://www.nisos.com/) - Solutions - [Manage Human Risk](https://nisos.com/solutions/human-risk/) - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/) - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/) - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/) - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/) - Services - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/) - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/) - Company - [About Us](https://nisos.com/company/about-us/) - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/) - [Client Success](https://nisos.com/company/client-success/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [News](https://www.nisos.com/newsroom/) - [Blog](https://www.nisos.com/nisos-blog/) - [Events](https://www.nisos.com/events/) - [Resource Library](https://www.nisos.com/resources/library/) - [Podcasts](https://www.nisos.com/podcasts/) - [Contact](https://www.nisos.com/contact/) - [Home](https://www.nisos.com/) - Solutions - [Manage Human Risk](https://nisos.com/solutions/human-risk/) - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/) - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/) - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/) - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/) - Services - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/) - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/) - Company - [About Us](https://nisos.com/company/about-us/) - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/) - [Client Success](https://nisos.com/company/client-success/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [News](https://www.nisos.com/newsroom/) - [Blog](https://www.nisos.com/nisos-blog/) - [Events](https://www.nisos.com/events/) - [Resource Library](https://www.nisos.com/resources/library/) - [Podcasts](https://www.nisos.com/podcasts/) - [Contact](https://www.nisos.com/contact/) # Blog ## Risk and Reward – the Importance of Knowing the Network by [Sean Weppner](https://blog.nisos.com/blog/author/sean-weppner) | Apr 21, 2020 | [gap analysis](https://blog.nisos.com/blog/tag/gap-analysis) The CISO’s role continues to evolve with the variables that change around them - ranging from the threat landscape, to the board of directors. These directly impact who targets you, who/what those attackers target to get access, and the resources you get to protect the company. But for the CISO, the foundation that everything builds on is their knowledge of the network that they defend. Fact: CISO’s who don’t have a reasonably complete understanding of the state of their network are inviting risk into their house, period. A CISO from a well known Silicon Valley tech company once told me that his job was effectively dealing with corporate risk - “I accept it, I manage it, or I offset it.” This is fine when you have an adequate understanding of what you’re protecting, but when you don’t, you can’t even identify the risk let alone manage it, and unmanaged risk can neither be dealt with nor insured against. This is one of the difficulties of the job. As an established leader at a company, you have to constantly challenge yourself to make sure the hypotheses that you made about the world haven’t become deprecated. Last week, I discussed these challenges with **Anthony Johnson, Managing Partner at Delve Risk** on the Cyber5. He emphasized that one of the top priorities for an incoming CISO should be “to understand the assumptions that were made by the existing security team."  Part of the difficulty is that you have to both empower that new team with your trust, while at the same time work to understand and challenge the hypotheses their team is built on. It’s not an easy position to be in. Whether you’re an established CISO at your company, or a new one, one of the biggest challenges you face is how you organize your team. Anthony specifically stated that when it came to team building, that you should “build your team around the hard questions that your organization has difficulty answering – if you’ve dedicated most of your staff to focusing on questions you can successfully answer, you should consider re-refocusing them on those problems and questions that you can't.” Working in cybersecurity, you see a wide range of situations and teams. Small companies that have their things in order, large companies that don’t, and vice versa. A prudent security leader should eventually be able to account for your network like the CFO balances the corporate books: down to the nearest host. If you can't account for the assets in your environment with near precision, you cant protect the network. If you’re looking for good place to start evaluating your own understanding of the network your responsible for - try this thought experiment that Anthony recommended. “Think of a zombie movie - if you’re running from zombies and go to hide into a house, in order to survive you need to know: where the doors and windows are, where the choke points are, where the weakest areas and strongest most defensible areas are etc.” If you can't answer these types of questions about the network, chances are there are some zombie processes creeping around unimpeded. **Check out more from the source on the Cyber5** Spotify - [https://open.spotify.com/show/1pFQKHhk1JJZf4of7fdeby](https://open.spotify.com/show/1pFQKHhk1JJZf4of7fdeby) Apple - [https://podcasts.apple.com/us/podcast/the-cyber5/id1502270117](https://podcasts.apple.com/us/podcast/the-cyber5/id1502270117) Google - [https://play.google.com/music/listen?u=0#/ps/Ipeppalsbx5c6t7avtz6yrx2t4i](https://play.google.com/music/listen?u=0#/ps/Ipeppalsbx5c6t7avtz6yrx2t4i) --- --- --- - Solutions - [Human Risk](https://nisos.com/solutions/human-risk/) - [Cybersecurity](https://nisos.com/solutions/cybersecurity/) - [Trust and Safety / Platform](https://nisos.com/solutions/trust-safety/) - [Corporate / Physical Security](https://nisos.com/solutions/corporate-security/) - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/insider-threat-intelligence-solutions/) - [Risk Assessments](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape Assessment](https://nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Executive Shield](https://www.nisos.com/services/executive-shield/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Insights® Investigation](https://www.nisos.com/services/adversary-insights/) - [Event-Driven Intel Investigation](https://www.nisos.com/services/event-driven-investigation/) - Why Nisos - [About Us](https://nisos.com/company/about-us/) - [Client Success](https://nisos.com/company/client-success/) - [Our Approach](https://nisos.com/company/our-approach/) - [The Dogpile](https://www.nisos.com/the-dogpile/) - [Team Pandion™](https://www.nisos.com/company/team-pandion/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [Blog](https://www.nisos.com/nisos-blog/) - [Resource Library](https://nisos.com/resources/library/) - [Podcast](https://www.nisos.com/podcasts/) - [News](https://www.nisos.com/news/) - [Events](https://nisos.com/events/) - [Law Firms](https://nisos.com/law-firms/) - [Federal](https://nisos.com/federal/) - [Media Inquiries](https://nisos.com/company/about-us/media-support/) **Contact** [info@nisos.com](mailto:info@nisos.com) tel: [703-382-8400](tel:7033828400) 2101 Wilson Blvd. Suite 304 Arlington, VA 22201 ![Nisos](https://blog.nisos.com/hs-fs/hubfs/Nisos_July2023/images/NISOS_logo_high_res_vert_white@2x.png?width=320&name=NISOS_logo_high_res_vert_white@2x.png "Nisos") [Terms and Conditions](https://www.nisos.com/terms-conditions/) [Cookie Policy](https://www.nisos.com/cookie-policy/) [Privacy Policy](https://www.nisos.com/privacy-policy/) ©2025 Nisos All Rights Reserved