Feeds

Step forward the chief information security officer

Leader of the pack

Top 5 reasons to deploy VMware with Tegile

What does the modern chief information security officer (Ciso) look like? The role used to be little more than acting as a glorified sysadmin but things have changed.

These days, Cisos must be all-rounders, concentrating not just on technology but on business too.

“In recent years, the role of the Ciso has become more business and risk focused," says Adrian Davies, principal analyst for the Internet Security Foundation (ISF).

Cisos have to contend not only with tasks such as project management, but also cost-benefit analysis and stakeholder engagement.

It is difficult to find technology experts who are also astute in these areas, which is why single, well-rounded Cisos are so valuable. The alternative is to team up a business-focused Ciso with technical experts who can fill in the gaps, in the same way that chief executives often need chief operating officers to help bolster their capabilities.

Davis argues that the low cost of opportunity afforded by cloud computing has made the modern Ciso’s job harder. Any employee with a company credit card can now access a cloud-based resource, often without management even knowing about it.

Call a plumber

Signing up for your own online customer relationship management service and uploading a spreadsheet of customer data to an insecure web application is one way that data can leak out from the edges of an organisation, under the Ciso’s nose.

As these risks proliferate, mapping business risk to information technology risk becomes increasingly important and should be considered a foundational skill on the Ciso's part.

That involves talking to people in different roles. The risks faced by the head of human resources are different to those faced by the accounting department or the chief marketing officer. The Ciso must represent everyone and be able to appreciate all perspectives.

This role also involves understanding and absorbing the needs of the broader employee base.

John Colley, Managing Director (ISC)squared EMEA, calls for counter-intelligence to avert these unwitting security risks. Not, as he puts it, to slap wrists but rather to break down barriers.

Knowing me, knowing you

In many organisations, one critical security risk occurs when users start circumventing the IT framework to get the job done. Colley suggests focusing on what users need and finding the technology that would help them to achieve their goals.

“The ISF believes there is a need for top management to be more embedded in the business, and trying new things such as simply walking the floor and talking to people," he says.

Good governance is not always present in information security

Davis says governance is also an important aspect. “When the security function adopts governance, it leads to better engagement with senior executives, helping to foster better understanding, minimise risk and limit reputation damage," he says.

However, he adds that good governance is not always present in information security.

“Cisos can help their cause by taking a government approach, allowing them to demonstrate to stakeholders – customers, partners, shareholders and regulators – that corporate data is being protected according to industry best practice," he says.

Increasingly, Cisos have to exhibit leadership qualities. They must listen and gather intelligence from a broad base of individuals. They must set the direction for a broad security effort and get others aligned behind their vision.

But there is one subtler challenge for the modern Ciso.

Parting of the ways

Inevitably, the business will find itself heading in a different direction. It may wish to roll out a service or product, or expand a particular operation, without being sure of the risks or security consequences. It may want to play down negative results from an internal security audit in case they adversely affect negotiations with a client.

The true challenge for Cisos is fulfilling their mandate in the face of resistance. They must ask the difficult questions and make the unpopular suggestions that will keep the company on the right track.

Do you have the cojones to speak up in the boardroom when the chief executive wants you to say something different? ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.