Security Lessons from the UK

Europeans, and Brits specifically, handle security differently than do the Yanks. Understanding why and how can help give both sides new ideas.

The result seems to be a morphing of the security leadership role. "It's starting to turn into a broader risk management role, and one which reports in at board level," says Greymans' O'Neill. Steve Hunt, former vice president on the IT management and services team at Forrester Research and a 22-year security veteran, agrees. It's actually a European phenomenon, he says, but one that seems to be gaining traction fastest in Britain: six to eight people drawn from functions such as legal, human resources, the CFO's office and IT forming a risk management committee and meeting as frequently as once a week. The evidence so far is anecdotal rather than statistical, but the trend can't be denied, he says.

"The remarkable thing is that it's often the head of information security who has launched this group, who calls it together and often who presides over it," adds Hunt, by now a firm convert to the notion. "I've started recommending this sort of steering committee be adopted here in the U.S. as a best practiceit's really amazing to see it in action, taking a holistic view of risk across the enterprise."

It's taken the heightened threat of terrorist action to prompt the change, but British executives could yet be a role model for their American counterparts.