![]()
CHAPTER 1: THE NATURE OF THE CISO ROLE
Technology presumes there’s just one right way to do things and there never is.
Robert M. Pirsig
American Writer and Philosopher
Chief Information Security Officers (CISOs) are bombarded with new challenges every day. In fact, the challenges that demand the CISO’s daily focus change so fast it makes little sense to list them here since they will be replaced with others tomorrow. Instead, let’s take a look at the very nature of the role and why it may well be one of the most unique and challenging in organizations today.
Information security and the role of the CISO has for far too long been about implementing the latest security technology. Yes, technology plays a large role in businesses today, but identifying and implementing technology is only part of the information security challenge an organization faces. In fact, in today’s successful organization, implementing technology is only a small part of the CISO’s role.
Today’s CISO quickly discovers that they are in a dilemma of sorts; they are held responsible for the protection of the organization’s information, but often reporting to the CIO who is rewarded for making the organization’s information more readily available to all. CISOs are in the business of managing information, not just securing it. Information that was once a static entity that stayed where you stored it, is now on the move, constantly flowing in and out of the organization. Traveling via laptops, thumb drives, PDAs, smart phones and all means of Internet connectivity, information can no longer be protected by simple perimeter-based security.
The beginning
The title of Chief Information Security Officer, CISO, burst onto the national scene soon after the attacks on September 11, 2001. Creating a dedicated office of the CISO became the go-to answer for many companies anxious to demonstrate a serious commitment to information security, disaster recover planning and business continuity. A CISO was appointed/hired because company executives believed a dedicated office and an appointed executive would be viewed by clients and regulators as the best way to address the security “issue.”
Many of the first CISOs came from the ranks of current employees that were simply re-cast into the new role. Most CISO offices were set up with the belief that responsibility for the organization’s information security is a task like any other that could be assigned to a single individual in the company. With few to no staff and limited budgets, minimal formal security education and a reporting structure through the CFO, CIO or lower, the first CISOs were simply tolerated and only appreciated during an audit or the recovery from a crisis.
Forever increasing threats
Law enforcement investigations over the past several years have discovered that cybercrime is an organized global business that hires, equips and directs hackers in their attacks on financial institutions and personal accounts. The creation of new malware programs in 2009 far exceeded any forecasts and today averages well over 55,000 new programs per day.2 The number of financial service companies indicating that they had suffered a data loss within the past 12 months rose to 42%, nearly a 50% increase from the previous 12-month period.3
According to Symantec,4 75% of enterprises surveyed experienced some form of cyberattack in 2009, showing that the risk is not limited to a few large organizations. Attackers are increasingly looking to exploit new Web 2.0 technologies and social networks for criminal purposes. Drive-by-downloads (infecting or taking over a legitimate website with the purpose of infecting visitors), social network infections, “vishing” (voice phishing), “smishing” (SMS or text phishing) and variations of spear phishing are all used by fraudsters around the world to attack banks, credit unions and credit card companies in order to attempt account takeovers.
Exploits against the ever-increasing sophistication of smart phones, like MITMO (Man in the Mobile), or building a botnet using the iPhone or Android phones, have become a greater threat as smart phones become more ubiquitous. Multi-factor authentication, once thought to be the pinnacle of layered security, has been defeated by Trojans subjecting users to “man-in-the-browser” attacks targeting online banking accounts.
And last but not least, the trusted insider remains the most dangerous adversary for any CISO. The frequency of insider-committed or assisted crime can be blamed on several factors, but the threat is predicted to increase in part because of the poor economy and the constant move toward ease of access to the organization’s data. A forever-changing and growing threat landscape is a fundamental element of the nature of the CISO’s role.
Challenges
As if the constantly evolving threat landscape is not challenge enough, most CISOs find themselves with limited resources and not reporting directly to top management. The role is large and complex, and the CISO often needs to make risk trade-offs when deciding how to spend their limited dollars or task their scarce human resources. Without a seat at the table with senior management, the CISO often makes risk trade-off decisions well above their pay grade. Risk decisions that should be made by senior management after understanding the potential impact on the business, are often forced upon the CISO.
Another substantial challenge for the CISO, is the human element. Whether it’s the lack of information security awareness or the innovation people display when trying to work around security controls to do their jobs, the human element remains a top CISO challenge. As tough as implementing new technology can be, nothing is as demanding as managing people during the implementation of change. Add to this an intensifying regulatory environment and limited available metrics and you begin to understand the challenges faced by the CISO.
The satisfaction
The CISO is meant to drive all information security functions within an organization and effect change across the entire enterprise. The role provides the opportunity to have significant impact and influence on the security posture of the organization. As cybercrime has emerged as a major national security concern, and compliance with new regulations pose greater threats to organizations, the CISO is expected to lead the company’s response.
If you love a challenge, enjoy learning, relish something new every day and want to make a real difference in the safety and soundness of your organization, the CISO role has it all.
![]()
CHAPTER 2: THE TRADITIONAL CISO JOB DESCRIPTION
Tradition becomes our security and when the mind is secure, it is in decay.
Jiddu Krishnamurti
Indian Philosopher
The position and title Chief Information Security Officer (CISO) refers to the individual in an organization with an exclusive information security focus. The CISO is the individual responsible for overseeing the overall corporate security strategy, security architecture and security function. The scope of the role traditionally covers all implemented security technologies and services, including security applications, perimeter defenses, physical and logical access control, and access management for all employees, contractors and visitors. As the company’s dedicated information security officer, this role also has enterprise-level responsibility for all data/information security policies, standards, evaluations, audits and corporate security awareness programs.
The CISO works with user and technical groups as well as internal auditors in the development and implementation of a security strategy designed to provide a high level of security over information and information processing systems while preserving and enhancing system access and usability.
A typical CISO is responsible for directing the overall activities of the security function along with the following roles and functions:
• Develop and implement policies, standards and guidelines related to information security.
• Develop, implement and manage the overall enterprise process for security strategy and associated architecture using security standards and best practice.
• Work with corporate executives, business managers, internal audit and legal counsel to understand security and regulatory compliance requirements and to map those requirements to current projects.
• Oversee the continuous monitoring and protection of information and information systems.
• Serve as the enterprise focal point for security incident response planning and execution.
• Investigate and analyz...
