The actual management structure probably depends on the type of organisation. It is quite common for the Chief Security Officer to be a person like an ex-cop who understands the threats and the villains. A cybersecurity specialist who understands the technology may then report, directly or indirectly, to the top security executive or at least work closely with him or her. Enterprises with physical goods and premises will probably find that structure fits best. But a bank or a government agency, an online service or a healthcare provider will almost certainly be better served by giving supremacy to the digital side, the CIO or a specialist deputy.
The salient point is that security has to be an integral component of everything digital and every electronic activity, from sensor to data centre, from email to private cloud, from point-of-sale to corporate accounts. And all of that is before we even begin to consider authorisations and authentication, from simple building entry to €50 purchase orders to inter-bank transfers in the millions.
As for data access permissions, role-based using Active Directory is really just a place to start for any organisation of scale. More and more what will be needed is a set of individual permissions with sub-sets of escalating security to match the value or risk of the resources being accessed or actions taken. If we can use biometrics for quick entry to restricted areas or simple factory clocking in, it does not make much sense for the CEO to be still using password/PIN. But all such credentials must be reviewed regularly, including those unwelcome compulsory changes of authentication factors.
Security conscious
A CIO of our acquaintance some years ago made a fairly ruthless job of introducing security discipline including mandatory password change at regular intervals. Alas, about a year later he took an extended and long overdue five-week holiday in the USA. Out of email reminder range. Conscientiously coming into his office the Sunday before his official re-start he found himself locked out of the building, much less his computer. Monday found him waiting outside for the MD to authorise his entry. Embarrassing, but it actually made his point.
Back up to the C-suite: for the foreseeable future, on whatever number platform, we are going to have to see a marriage of innovation and security with dynamic renewal of our systems and processes. One of the essential needs is a range of user-friendly solutions to imposing security from the top, on employees, and partners and yes, even customers, but in acceptable ways. It is at this stage notorious that the war between security and the hackers, crooks, common embezzlers and over-curious staff consists of never-ending escalation in both electronic tricks and age-old conning of suckers. If the e-villains are more innovative than the security guys we are in real trouble. Since the really big (and invisible) bosses can pay the cyber talent multiples of any legitimate organisation’s reward structure (and code does not take fingerprints), we are definitely in what the ironic Chinese curse refers to as ‘interesting times’.
So, let battle commence and let our CIOs lead the charge. The CIO as heroic security leader is something of a new image but the forces do need to be mobilised, trained, disciplined and supported. Whether the role expands to take over responsibility for all security or just the digital aspects is probably not all that important, depending on the particular domain and organisation. After all, CIOs certainly lead the ICT for other distinct functions like production, distribution, marketing and, of course, financial accounts.
However, despite our frequent talk about dynamic systems and constant innovation, most of those systems tend to have bouts of sometimes frantic renewal activity followed by relatively long periods of relative calm. Above all, apart from systems failures they are not usually impacted by unexpected or external events to the extent of requiring immediate, even real-time measures.
Security, on the other hand, is the domain of constant vigilance. For that reason alone it belongs close to the centre in ICT. There is also the question of managing suppliers. From relatively simple email filters and firewall software all the way up to fully outsourced digital security, this is high tech and belongs in the portfolio of the CIO. In fact it cannot be separated. Whether this is now the ICT ‘Era of Cyber Security’ (or perhaps more accurately ‘Insecurity’) the important thing is that every organisation has the best systems in place and properly managed.
Ltd
