September 18, 2003 — CSO — "Security can't be a necessary evil, it must be a core business process. You can't sit around and wait for something bad to happen. To make this mind-set routine, security must start high up in a company, where it can reach across the company's boundaries. I'm encouraged that this is, indeed, starting to happen. Companies are beginning to look at the problem the right way."
The Title Fight
"What exactly is a CSO or a CISO? We see salespeople who call themselves CSOs now. I'm somewhat discouraged by the misuse of the titles. I urge companies to understand the operational and strategic responsibilities of the role so they don't end up with, you know, a salesperson as CSO."
How to Start
"First, hire someone with business expertise. Then recognize that security doesn't happen two weeks before a project starts. It starts the moment you have an idea. Then, it's training and awareness. Constantly."
Cooperation
"It used to be a lot of work to get companies to see that you can't divorce the public critical infrastructure from private industry. One of the positive responses to 9/11 is that now it's hard to find someone who can't see the interdependence."
The Future
"I can't imagine a company in five years without a CSO or executive in charge of security. Already the position is having a tremendous coming out, reporting to the CEO in some cases. Security will continue to be elevated to a position of unique authority."
Profile
Company: eBay
Current position: Vice president and CISO
Previous positions: Former vice chairman of the Critical Infrastructure Protection Board; and prior to that, CSO of Microsoft
Other endeavors: Coauthor of the "Draft National Strategy to Secure Cyberspace"
Read more about data protection in CSOonline's Data Protection section.
The challenge of true data protection spans databases, internal and external networks, physical and offsite storage, business partners and more. These resources offer expert perspective from the basics through specific key elements of data protection strategies.
Network security basics
Protection, detection, and reaction—those are the three underlying principles your security program must embody
Computer incident detection, response, forensics
Richard Bejtlich shows how to measure and improve the maturity of your incident response
A few good IT security metrics
Stop counting blocked malware attachments and measure things that can contribute to meaningful change
5 key cloud security trends
Cloud security is evolving rapidly—stay on top of it
IT risk assessment frameworks
How to do end-to-end encryption
How to compare and use enterprise antivirus
Also find sample data protection policies in CSO's tools, templates and policies library
- The CISO's Survival Guide to Securing Data
- Data Privacy and Protection in Production Environments: New Research from Ponemon Institute
- FireEye Advanced Threat Protection KnowledgeVault
- Five Tips to Consider in a Data Security Strategy for Smartphones and Tablets
- Moving Your Email to the Trusted Cloud
- Comprehensive Server Protection
- Busted: When security tools fail
This is a sequel to this morning's post about all operating systems, browsers etc. being vulnerable. A reader correctly noted that I forgot to mention that just about all the security tools out there are flawed, too. The exchange on Twitter went down like this: - Hey Linux, Mac and Windows users: It's ALL vulnerable
- Howard Schmidt went the distance
More Salted Hash with Bill Brenner
