C-Level Exec with Tech Savvy, Physical Know-How

C-Level Exec with Tech Savvy, Physical Know-How

By Scott Berinato

April 15, 2005 — CSO — Security convergence is an ideanot yet a reality. Correspondingly, the converged CSO is a goal more than a role. But it's important to start thinking about how to get to that place where you, the chief security officer, will oversee a security group that encompasses all aspects of the discipline. For thoughts on what the converged CSO role will look like, CSO spoke with Pete Metzger, who, as a partner in the Global Security Practice at executive search company Heidrick & Struggles International, helps place CSOs. He is also one of CSO's career advisers.CSO: You've said it will take awhile before we see a converged CSO. Do you still think that and why?Pete Metzger: Yes. It's because the cycle of responsibilities of CSOs is moving to a higher level, and with that come more responsibilities. The industry trend is for management to fold more functions into the CSO's domain. One of those functions is infosecurity. Are we folding in so many responsibilities that we'll expect too much from CSOs? It depends on the capability of management. But it also depends on the capability of the CSO. Both have to be honest about what they need. Surely, though, folding the wrong ingredients in can make a terrible cake. Do you see either "side"physical security or infosecuritytaking the lead with convergence? My personal view is that the person who has more physical security and threat analysis experience can at least be conversant enough in infosec to be more effective in a converged role. That said, an argument can be made the other way. But, right now, if you look across the industry, the industry looks at it that way toowith physical security folding in infosecurity.

Currently, it's hard to find experienced people for CSO posts. We're six to 12 years away from having a seasoned team of people to implement these multidisciplinary programs. The business skills are important, but that's just another way of saying people skills. Whether you can read a balance sheet early on is less important than whether you can understand the business.Can we expect the usual culture clashes on the road to convergence, or is security important enough to everyone that they'll be forced to get along?There are a couple of culture clashes that we're going through now. People who came from more traditional security backgrounds are feeling a bit overwhelmed by the national scope of most security jobs. And I think the other culture friction point is when you've got people who've come up through different stovepipes who are now coming out of the same chimney. That's not always harmonious. What can we do about that? We need to recognize the stark truth: None of us can operate independently. We need to get over our perceptions. Management needs to lead by demonstrating support for convergence. Reporting relationships are another pain point. To date, the security person has been somewhere in the corporate staffeither reporting to HR, the CFO, CIO or some other office. My view is that the security person should have visibility at the highest level and have routine meetings with leaders of the business.It seems so cliché that the endorsement of management will actually help. Will it really?If the person in charge says, "Here's my vision, and here's what I endorse, along with the board and the shareholders," that's very strong. I'm telling you, it works. Anytime management invites you into the boat, get in. It's a big deal.

Read more about data protection in CSOonline's Data Protection section.

Other stories by Scott Berinato

• Print