Unified Security: The Payoff...The Pain

The benefits of running a unified security operation are real. CSOs say they can lead their functions to be more effective and save money at the same time. But getting there is tough.

To improve efficiency, strategy and communication, he led the consolidation of the department, which was completed a year ago. (Pembleton is now chief security and privacy officer, a title he took on in January.) The four functional groupsinformation security, physical security, compliance and privacywhich previously reported to different parts of the organization, now reside in Pembleton's security and privacy department. Now security can look at regulations such as the Health Insurance Portability and Accountability Act and Sarbanes-Oxley, for example, and address them with a centralized focus, not a haphazard one.

One project his team completed last year was reducing the 125 or so websites that had references to some type of privacy or security down to one portal for all internal security. "That was to improve efficiency in the company and improve communication to the company and clients," he says.

Pembleton is also replacing customized solutions with standardized ones. For example, he's consolidated security monitoring and access control to regional data centers so that policies, while managed locally, are set at a central location. (That took place prior to the security department reorganization.) Next up: centralized user authentication.Payoff #4 Convergence gives you a more versatile staffAlthough the unified security theme resonates today at Wells Fargo, it wasn't long ago that the message was a little more garbled. Previously, external and internal investigations operated separately. Each had its own manager. That led to inefficiencies, where two separate teams could be investigating the same case. And if the case happened to be in Boise, Idaho, Wipprecht spent money to send somebody from the corporate office in San Francisco to work with the regional agent.

That changed in February 2004, when Wipprecht brought external and internal investigations into his new, converged organization and began cross-training most of his agents.

Now the regional agent, trained in external and internal investigations and physical security, can run the case from Boise solo, giving security more bang for its buck and improving response time. Cross-training has also made his agents more aware of areas that weren't previously part of their job descriptions. In the past, the physical security folks thought a lot about homeland security but not investigative issues; investigators, conversely, were less observant about homeland security. Now the security organization is more cohesive, with different divisions pursuing similar goals. "The cross-training is an awakening of what they ought to be looking at internationally, nationally and locally," says Wipprecht.

Triwest's Pontrelli and Pemco's Telders cross-train their physical and infosec staff. "It's mostly a people cost savings," says Telders. "I can take someone trained in CPR and have them do e-mail filtering and password accounts. I can cross-train staffs so they can cover each other, so my staffing costs are down. People assigned to projects can get cross-trained on the job," he says. Pontrelli also likes the fact that cross-training gives his team members greater career opportunities.Payoff #5 You save the company moneyOK, you'd like to be converged, you've talked up the benefits of single points of contact and holistic strategies and aligning security operations with business goalsand you've met with glassy eyes, thinly disguised yawns and general apathy from senior execs. Now's the time to pull out your trump card: Cost savings. Dollar signs. Cold, hard cash.