Information security officers need to sharpen their risk management skills


This article can also be found in the Premium Editorial Download "Information Security magazine: Comparing seven top integrated endpoint security suites."

Download it now to read this article plus other related content.

Being a figurehead in operations isn't enough; CISOs need risk management know-how.

Let me begin by saying I'm friends with many CISOs, and I have done significant business with, reported to, and have been a CISO. During the past five years, I've seen trends that lead me to believe the CISO role needs an update, and those who fail to recognize this may soon wonder where their careers went.

Most CISOs I have run across are trying to build and maintain empires with hands-on operational employees, such as firewall administrators, intrusion detection specialists and forensic analysts. In most IT organizations, however, there already are well-established operations teams that cover network infrastructure, server and desktop administration, application development and maintenance, and other areas. As security has evolved from a niche discipline into something every IT professional should be aware of, it makes more sense to take a strategic approach by migrating similar operational functions into well-established groups that overlap with security. Trying to win the headcount war is a losing battle for security managers.

Even in larger organizations with big security staffs, many CISOs have very little political power. Research indicates this problem stems from a poorly defined role for information security management. Last year, Gartner released

    Requires Free Membership to View

a study on the top five issues for CISOs; chief among them is the matter of whom CISOs report to, and who in turn reports to them. Most organizations place the CISO in the IT hierarchy. This invariably leads to the CISO being another operational player, with the same strategy for acquiring budget, headcount and attention from executive management.

Over time, information security operations will migrate to other areas of IT. Network intrusion detection and firewall management will move to network operations, server hardening and file integrity monitoring will fall under systems administration, and application security will be the responsibility of development teams. Where does this leave CISOs and other security managers? How can CISOs become real strategic players and not just security figureheads within IT operations?

This was first published in November 2007

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: