Case Study
Reinventing T-Mobile's Security Function
T-Mobile needed to reinvent its security function, so it recruited a veteran team to shape a new asset protection division. The goal: Inject risk calculations into every business decision.
By Scott Berinato
That challenge is compounded by the fact that the overarching plan is often interrupted by in-the-moment security issues. They don't stop popping up. The speeding car getting its tires changed must negotiate potholes too. In a perfect world, Porcaro says he'd lock the team in a room for three years and come out when they are done with the project. Instead, the company continues to grow, and major unforeseen events develop. With business continuity and disaster recovery still in development, Katrina hit. Even as T-Mobile's BlackBerry e-mail service grew, a patent infringement lawsuit threatened the very existence of Research In Motion's BlackBerry service. (The suit was recently settled.) "So my only caveat is three years is ideal," Porcaro says. "We'll have to come back and revisit it."
A Subjugation of Egos
A remarkable fact of T-Mobile's new asset protection group is that Morgan and Porcaro were able to recruit so many CSO-level executives who were willing to report to Porcaro, a director, who reports to a vice president, who finally reports to the CFO. New hires Telders and Robertsâ¬70-plus years' combined experienceâ¬are used to playing at the highest level of major companies. Why would they come into a place where the CFO was several steps up?
All three men say it was the entrepreneurial opportunity, the chance to build a security function from the beginning, that convinced them to join, regardless of titles or altitude on the org chart. "Sure I'd love to be high up there, but liking the job is far more important than liking the title," says Roberts. (He also says, quoting a former Secret Service colleague, "I don't care what you call me, just pay me right.") "When I came out here to interview, I wasn't impressed with the cost of real estate or living, and frankly I was thinking, it's just an interview. But when Frank showed me what they were doing, it totally changed my mind. I thought, 'We could do something great here.'"
"What attracted me personally," adds Telders, "was that what Frank described was the CSO organizational model, even if we don't use that specific title. We all share the belief that this is the right model for corporate America."
"As I interviewed I was being recruited by another company," Porcaro says. "Two things made a difference for me: One, the company seemed prepared to put their money where their mouth is. And two, I got very excited to be part of a bigger risk management organization.
security department
Security Directions: A Virtual Conference
Available On Demand Sept. 30 - Dec. 30
Join us for a virtual event with candid, expert information on top security challenges and issues - all from the comfort of your desktop.
Protecting PII: How to Work with IT to Manage Risk
Understand the critical nature of the test data privacy problem and get tips on how to work with IT to implement a test data privacy program.



