There is a saying that goes something like, If leadership is not paying attention to something then no one in the organization will pay attention to it. Cyber security is not an exception to this rule. Leadership must pay attention to this important element and must apply the necessary resources and personnel to maintain a strong posture.

1. Smaller organizations may not be able to afford an executive level person dedicated to security. Assume a company has no CISO, who should lead the effort to hire a senior level, hands-on information security person? Why?

2. You are that person. You have 4 finalists; each finalist is essentially equal in experience and each has a CISSP. One has the CISSP and a Security+, the others each have a CISSP with a single concentration (ISSAP, ISSEP, and ISSMP, respectively). Which one do you select? Why?