Layer 8

I’m definitely sympathetic. Been exactly where you are. Source Boston is a great conference for folks like us as are the BH Executive Briefings if you can snag an invite. Classwise though, I’d love to go through one of those Executive MBA courses and get a much deeper dive into business issues.

I am feel like I’m a similar predicament, although I suspect I’m a little closer to the metal than you are - mostly because of the size of my organization vs yours.  But I do feel the squeeze of not having any place to gain knowledge.  One way I earn my CPEs is teaching and lecturing - which forces me to focus my thoughts temporarily on a particular facet and the audience/student feedback often teaches me something as well.

As for pure classes or seminars, I love the legal stuff.  I wish there was a Cyberlaw for CISOs class or decent book out there. I do have a lot of lawyer and lawyer-like friends, so I’m constantly egging them on for ideas.

2 cents’ worth, or less: I see people using Brand Protection, Intellectual Property or Enterprise Risk Management initiatives as an opportunity to start expanding your knowledge of fraud, law, physical security and other related categories.

Also, an extra half-penny: http://www.csoonline.com/article/494878  My thoughts on a key direction in which the security discipline will grow over the next half-decade.

Thanks, Derek.  Absolutely, I agree with you—if you can turn the data you collect into intelligence in a way that can benefit the business at large, that’s the best possible outcome.  Tracking data flows to help define business processes, tracking interactions with partners, measuring customer volume, and so on.

Study up on Kung-Fu and “The Art of War”. Everyone in security needs to have that behind them

In all seriousness, you do have the unique ability to cover security topics with intellect, creativity and humor in a meaningful way. Teaching, speaking engagements or book writing would probably be useful as you do learn from teaching as dunsany mentioned. Unfortunately teaching and book writing can take a great deal of time.

Then again, you can always take some classes on law, statistics or some kind of scientific or business analysis disciplines. Think of how you would tie them into your existing role and your business from your own slant. Some higher education programs may have something you are looking for.

Btw, if you write a book, I want to know about it. It would be a great add to my collection.

This is a very crucial and persistent issue you have brought up.

Being an infosec manager myself, I too have faced (still facing!) similar problem.
I have always struggled between being a security generalist and security specialist. I have been consulted (demanded!) many times on topics ranging from securing a particular web app component to legal aspects of data privacy on a particular cloud environment to suggest best method of configuring a Microsoft group policy. I believe the idea of a mile deep and a mile wide will make the person impossible to hold on his knowledge and delivery what is actually required; of course one cannot be both master and jack of all.

In my opinion, the industry is still groping on what to expect from a CISO. Expectations from a CISO are normally different from other CXOs. It is this lack of clear expectations and demand from all nook and corner that makes the problem worse.