Basics

New Security Leadership: The Basics

Maintaining the right level of boardroom and employee security awareness is a consequence of leadership. And more effective ideas and tactics are replacing the old, reactive security leadership paradigm. CSO looks at what's Out and what's In.

By Derek Slater

OUT: Silos

Information security in one stovepipe, corporate in another, audit staring suspiciously from across the hall, disaster recovery handled by the facilities group... you know the usual drill. Security functions have a history of fragmented organization. "Each of these departments' main mission is 'to protect company assets;' however, each usually reports through a different hierarchy," one privacy and IT security manager puts it. "It makes no sense."

Historically, the greatest chasm - not just organizationally, but culturally as well - laid between information security folks and their corporate security counterparts. Each side has a list of perjorative ways to describe the other's profession and professionals (propellerheads vs. knuckledraggers, etcetera).

IN: Holistic security

Enough squabbling already. Disjointed management and lack of communication leads to a weaker security posture and wasted money due to duplicated efforts.

"The truly sophisticated companies are starting to look at a coordinated approach to physical security, information security and risk management," says Lance Wright, principal at the Boyden Global Executive Search company.

Consider these specific areas where holistic security management pays off:

-Business continuity Mike Hager, who helped get OppenheimerFunds up and running four hours after their offices and systems at the World Trade Center were destroyed on 9/11, puts it best: "Some companies have people who do information security, and people who do physical security, and people who do business continuity. The three people may come up with three separate answers about what to protect. If you have a total protection program, you can save a lot of time, money and effort. It just simplifies the whole process and makes it more effective."

-Hiring and firing When an employee comes on board, she may need a number of assets and rights before she becomes productive a building access card, a laptop, a network password with access to the right applications, a signed non-disclosure agreement, a business credit card, a company car. Some of these are physical and some are digital. In a company with a well-managed, holistic hiring process, that employee can be up to speed in a jiffy. Conversely, a company with disjointed access management can expect a much longer ramp-up time. That's lost money. And if the employee is abruptly terminated, the poorly managed company stands very little chance of recovering all its assets and disabling all necessary access rights in a timely manner.

-Intellectual property protection IP (patents, ideas, classified research) is stored in many forms, from data on the corporate network, to CAD printouts in the trash can, to drawings on the whiteboard in the graphics department. Losing that proprietary information can cripple a company competitively. Bill Boni, CISO of Motorola and a former Army intelligence officer, notes that the only way to protect intellectual property from threats inside and outside the company is by interconnecting all the necessary defensive measures - logical, physical, legal and otherwise.

-Regulatory compliance Sarbanes-Oxley says the Board of Directors has a fiduciary responsibility to know what risks its business faces. Who's going to give them an accurate picture if no one has visibility across all security domains?

-Coordinated access management It's midnight, and the network control center notes that the CEO just logged on to her office workstation. Problem is, the building access card system notes that the CEO left the building five hours ago. If the network and building access controls were coordinated, the night watchman would know he needs to take a stroll down the hall and see who's sitting at the CEO's desk and using her account.

The most obvious way to manage security holisitically is to put make one person responsible - a CSO. But even in companies where that's impractical, creating new lines of communication and knocking down formerly adversarial relationships is a must.

(For more about the benefits of holistic security, read "Convergence: The Pain The Payoff" from our special report on convergence.)

Compiled from CSO Magazine and CSOonline.com. Contributing writers include Scott Berinato, Daintry Duffy, Sarah Scalet, Tom Wailgum and Malcolm Wheatley. Send feedback to Executive Editor Derek Slater at dslater@cxo.com.

• Email
• Print
• Comments
• Digg This
• SlashDot

• Sharpen Up Your Security Resume
• Physical and IT Security Convergence: The Basics
• How to Use Metrics
• A CEO and CSO Who Actually Communicate about Security
• State of the CSO 2008: Powering Up