Compass Awards

Bob Weaver: Change Agent

July 01, 2003 — CSO — Weaver has served in government for nearly 28 years, 21 of those years in the Secret Service. He currently holds the position of deputy special agent in charge of the Secret Service's Financial Crimes Division and is also the founder and head of the New York Electronic Crimes Task Force, where he supervises a dedicated staff of high-tech crime fighters and criminal investigators. Weaver was at the forefront of a major mind-change in law enforcement regarding electronic crime, helping shift the focus from prosecution to prevention.

"CEOs and CSOs must take their risk management proceduresand this includes both physical security and cybersecurityseriously. Some people put the two disciplines together and call it enterprise protection planning, while others call it risk management. I suggest that CEOs, CSOs and CIOs consider that streamlining these two disciplines can provide them with an extra level of fast-tracked communication when times get tough. And having better coordination and communication is just good business. What you may see in the next few years is a movement toward placing the physical security and cybersecurity components closer together in the corporate world so that companies and employees can better protect themselves and their businesses.

The best way I can explain the need for preincident planning is this: Get up from your desk right now, walk out the door with nothing but the clothes on your back, run for your life and know that everything you leave behind has been destroyed. And then tomorrow, go back to work. If you can stand up under that battle-tested environment and actually run your business the next day, then you have the kind of robust and redundant systems that can only come from preincident planning. You can't make that up as you go along. You have to set preplanning policies and procedures at the strategic, tactical and operational level while at the same time protect your data and intellectual property. This means taking a look at every asset and thinking, If I lost this, would I still be in business? Decide what's most critical to the business, and put backup plans in place so those things can be restored quickly. Your plan must be designed for business continuitynot just survivabilitybecause you need to be able to keep your company up and running. That means having contingency plans, partnerships with other companies and government agencies, and a redundant network in place. And then everyone in the company must know the pre-incident and continuity plans so that if the plans are activated, each employee knows what to do.