Compass Awards

Bill Boni: Industry Advocate

July 01, 2003 — CSO — Boni has spent more than a quarter century as what he calls an "information protection specialist," his career spanning from government rolesa U.S. Army counterintelligence officer, federal agent and project security officer for the Star Wars missile defense systemto private industry. He also has served an unofficial role raising the general awareness and understanding of information security issues, both as a writer (Boni coauthored Netspionage: The Global Threat to Information in 2000) and commentator in various media outlets.

"The unexpected and unpredictable climate we live inglaring examples being 9/11, war with Iraq and the outbreak of SARShas thrust the chief security officer into the limelight, perhaps a place where these technologists and law enforcement experts are not quite comfortable. But organizations are adding CSOs to their rosters because they are looking for security leaders. Now that CSOs have a seat at the table, it's time for them to start adding to their repertoire of skills.

Security has become an embedded expectation of society: by the consumer, the business, the employee. And the CSO is expected to have the legal, practical and technological knowledge needed to 'protect from the unexpected,' quite an oxymoron in itself. CSOs are increasingly asked to take over operations such as consumer privacy and data protection as well as to ensure that whatever they do is in compliance with current legislation. In order to fulfill these big expectations, I consider myself a perpetual student. I read just about anything that even remotely deals with security. And I just returned from a week of executive training at the Kellogg School of Management at Northwestern University. Ramping up on managerial skills, finance, marketing and product development is as important as expertise in risk management and will be key in the success of a CSO.

As the role develops, the CSO will become more of a chief risk officer, an executive in charge not only of the technological risks a company may face but also the business risks married to security concerns. Many CSOs have law enforcement pasts, and now more than ever, it's important to hold on to that past. Having the right cybercrime contact on Capitol Hill and keeping abreast of what government is doing in the wake of 9/11 and the development of the Homeland Security Department are just part of the CSO job.

The CSO must also realize that risk is international. Knowing how to protect yourself in the United States is important, but learning how to protect yourself globally is equally critical. That means you have to know the full diversity of laws and cultures in the global workplacehow identity theft is investigated in Romania, who the cybersecurity experts of Indonesia are and how to reach them. The Internet is a perfect breeding ground for international worriesa common denominatorand a threat for just about every business, consumer and government in the world."