In Depth

Security Accountability: The Fault Line

Welcome to a world where projects fail, computers crash and secrets escape...and you don't have to be the fall guy.

By Tom Wailgum

Page 6

He says, above all, that his business peers at Nortel want his group to maintain value and independence in everything that it does and to protect the drivers of the business. Simply stated, Williams says CSOs need to "do strategyand executionwell." Which is no small task.n n nA classic case of risk versus reward was staring down at Dardet and his business and legal colleagues.

Just after midnight, the final decision was made by the business head, Stephen Donaghy, the vice president of the project management office, to go forward with the contract. Ultimately, he and the three lawyers felt that other general provisions in the contract, which required the vendor to adhere to JM Family's security policies and notify JM Family if a breach actually did occur, were enough of a safeguard against future problems.

In retrospect, Dardet speaks confidently about the conversations they had that night. He's pleased that his business peers were debating infosecurity concerns with him before a final decision was made.

Although Dardet is comfortable with the decision, he's quick to classify this drama as a "very special case due to the financials associated with it." In the end, the risk/reward equation ended in a "Let's go for it." And though he played a serious role in the negotiations, Eduardo Dardet did not make the final call. And that's fine with him. n n nAs much as accountability has to do with awareness and process, it also has as much to do with relationships. That means that CSOs cannot simply hole up in the security department and send out e-mail policy reminders from time to time. CSOs need to put a face on the security department. Their face. And if they can build trust and credibility with their peers, other executives will feel that much more comfortable signing their names on the dotted line.

But most CSOs will advise you to get to know the business and to show your business peers that you think business first, security second. "CSOs have to be an enabler rather than an obstructionist," says William Besse, who's in charge of the physical security for Belo, a large media company with businesses in print, broadcast and interactive media. "CSOs can mandate what to do, but they'll leave [the security function] out of the process if you don't understand their business problems."

Dardet agrees. "We have to give them something that they can make a judgment about," he says. But he stresses that you have to be clear about the business specificsto know exactly how the security issues relate to the businesspeople and their decisions. "If you don't have that, the business head will say, 'Well, do you think, or do you know?'" he says. And a CSO should always know.