In Depth

Security Accountability: The Fault Line

Welcome to a world where projects fail, computers crash and secrets escape...and you don't have to be the fall guy.

By Tom Wailgum

November 01, 2003 — CSO — If corporate America played out in true Hollywood fashion, and CEOs and other top execs were the A-list actors, CSOs would still be billed as desperately trying to gain celebrity status, continually relegated to B-level buddy-cop comedies and tired sequels. Never a star. Always a supporting player. But events more dramatic than any screenwriter could have ever penned have given CSOs their big break. Security awareness is at an all-time high. Faster, fancierand less securetechnologies demand the scrutiny of savvy security executives. Nervous employees need comforting. The whole country is on alert. It's high time they take center stage. But it's not the time to take the responsibility. At least, it's not time to take all the responsibility.

In fact, it is your job as CSO to analyze the vulnerabilities your organization faces and to suggest ways to best mitigate those risks. Without the guidance of a CSO, truly informed decisions are impossible. But it's the job of the other executives who own the project to determine how much riskor even which risksthe business wants to take on.

Too often, however, we bet you get caught up in the political infighting of the blame gamewhen IT networks are compromised, top-secret project plans leave the building, or money is lost and the business suffers. That's because it's easy to point to the CSO if a project tanks or gets cut off because of a perceived security hole. It's easy to point to security vulnerabilities in the latest version of a product release or in a freshly inked outsourcing deal when, as a result, your company's competitor scoops up the potential business.

But truly, how accountable are youor should you bewhen something goes wrong? And for what? In other words, where, exactly, does the buck stop when it comes to making the decisions that involve security?

"Security accountability falls into some ambiguous management space," says Carl Herberger, director of information security services for SunGard Availability Services.

"Risk and business opportunity are intertwined and must be weighed together," he adds. "Doing so obligates CSOs to become great communicators, to interpret and discuss the interplay of business objectives, the range of potential threats associated with them and the costs of mitigating those threats. But it falls to the relevant business executive to make an informed call about whether the risks outweigh the accompanying opportunities."

There's no getting around it: You will always be responsible for presenting the risk-based facts as you see them. That's your job. You analyze risk. Dissect it. Know it. Own it. Live it. You study possibilities, you research uncertainty, you ask What if? Then you consult, speculate and study it more. You speak in technical terms. You speak in business terms. You build a report. And then you present your findings.