Which is the better road to CSO/CISO?

What is the better path to take to become a Chief Information Security Officer? Receive a MBA then CISSP>CISM or MS in Information Security/Assurance then CISSP>CISM. And which degree is harder in content?

Find more posts tagged with

SAVE $250 on Your Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Boot Camps

Comments

JDMurray

Masters degrees in Business Admin and InfoSec are so different that it's almost apples-and-oranges to say which one is more difficult. The MBA has a lot of accounting that's not in the InfoSec degree; InfoSec covers a very broad range of domains, many of which are not covered by an MBA. Both degrees will cover some mutual domains, like project management and risk management. You can also have MBAs that are specialized to a particular industry, such as IT. InfoSec programs can also specialize, such as towards computer networking or project management. And, of course, the university that you attend is also a primary factor of difficulty.

drakhan2002

The farther up in the organization you get, the less technical you need to be. Business skills are required for the "C" level positions. My entire 15 year IT career has been in Fortune 500 companies ranging from Toyota to Proctor & Gamble to a few different financial institutions. In many of these roles, including my current role, I work directly with the CIO and upper level management personnel. I can only relate to what they have told me when I've asked them similar questions - business skills are required for those roles. So...focus on your MBA over your technical certifications. The CISM is a great certification if you want to understand auditing. The CISSP is the "gold standard" certification for Information Security.

Get the MBA, then pursue the CISSP/CISM if you want...but that is the fastest way to CIO seat. I don't think having the certifications will help or hurt you. The might make you look like you're motivated and have a deep understanding of these issues, but I doubt they will necessarily be a determining factor in the decision to get you the corner office.

JDMurray

drakhan2002 wrote:

Get the MBA...

Do you have any advice on the type(s) of schools to select for an MBA? (Private universities versus state universities, brick-and-mortar versus distance learning, stay away from XYZ, etc.)

royal

jdmurray wrote:

drakhan2002 wrote:

Get the MBA...

Do you have any advice on the type(s) of schools to select for an MBA? (Private universities versus state universities, brick-and-mortar versus distance learning, stay away from XYZ, etc.)

I'm interested in knowing this as well. Several years from now, after I get a lot of experience, I want to go for my MBA to start moving up into the Executive ladder (CIO, etc..) This is a long-term goal of mine that is many years away, but it's not bad to set goals in advance.

drakhan2002

I can only tell you that people I've worked with in large organizations received their MBAs from a brick-and-mortor school. The larger, well named schools.

In my opinion though, as a Master of Science learner in a distance school, I believe that in the coming years this will become more and more "common place." In 10 to 15 years, distance education will not have the "stigma" that it still seems to have - although it is getting better. I believe that employers are hungry for people who have advanced degrees. It shows that you are a professional who cares deeply about their own development. It shows that you have learned the skills required to drive business processes...not follow them.

Since you're interested in becoming a CIO of a large Fortune 500 organization, I would recommend going to a traditional school. If you're content with working as the CIO of a smaller organization, then any MBA would likely be a huge plus. You can alway parlay your experience in a smaller organization into the larger one.

In my current organization, we are are in the middle of the Fortune 500 - our CIO came from GE and has a MBA from Duke University.

drakhan2002

Found this little gem in Certification Magazine, Febuary 2007 issue. It is called "Your Career Path to CIO":

http://www.certmag.com/articles/templates/CM_gen_Article_template.asp?articleid=2596&zoneid=1