Security's Connections and Intersections

September 29, 2008 — CSO — Security is perhaps the most difficult intellectual profession on the planet. The core knowledge base has reached the point where new recruits can no longer hope to be competent generalists; serial specialization is the only broad option available to them.
—Dan Geer at the Source Boston conference, March 2008

Specialists are in many respects the lifeblood of a security organization. It takes years to learn the nuances and details of financial fraud. There is no shortcut to this knowledge. Similarly, you don't become great at network forensics by spending a few casual hours here and there reading documentation. Excellence in any area requires hands-on experience, trial and error, care and thought. And security's various subdisciplines aren't static; today they change faster than ever, demanding ongoing study and training even from longtime veterans.

However, for better or for worse, business problems often resist being crammed into narrow shoeboxes. As Malcolm Wheatley's article Investigations: Merge Ahead demonstrates, internal investigations are a case in point. If an employee is suspected of theft or fraud, the investigation may entail some network forensics. And some financial audit work. And a look at building access logs or surveillance video. The right mix of specialists involved depends on the particulars of the case, but it's increasingly unlikely that a single specialist is going to resolve a case of any complexity.

The inte rsection of security and safety is another example, explored by Fred Hapgood. Con-way Freight CSO Curtis Shewchuk spells out the challenge: There are synergies between the two areas that organizations can and should look to exploit, but at the same time just staying on top of OSHA or C-TP AT requirements demands a specialist's full attention.

So add it to the pile of challenges facing every CSO today: You have to figure out how to address the demands of specialized fields while keeping your other eye on the intersections and connections among them.

Dan Geer himself—who states the case for specialization in the opening quote above—is, ironically, also one of the field's most nimble minds, and one who continually casts light on security by putting it in the context of other disciplines. So it's appropriate that you'll find more of Geer's observations in this issue of CSO as well, in a Q&A with Senior Editor Bill Brenner.

I hope you'll find that Geer's thoughts, and indeed the entire September issue of CSO, help you look at security's connections and intersections in productive new ways. ##