Welcome!

Blog Feed Post

Determining Who Should Be in Charge of Cyber Security

Security has quickly transformed into a major issue for most businesses. As headlines highlight the now common incidents of security breaches, where victims as large as Target, JPMorgan Chase, and Sony have to struggle to repair the damage, many companies are prioritizing their cyber security needs, hoping to avoid becoming the next victim of a hacker’s wrath. Of course, it’s easy to say that security problems need to be addressed quickly. One of the biggest obstacles is figuring out who should spearhead the effort not just to improve security but ensure no attackers infiltrate in the future. It’s a daunting task made all the more difficult by the lack of clarity regarding the nature of cyber security for an entire organization. While statistics show that companies are more willing to spend on IT security, all of those resources will go to waste if they don’t know who should be in charge.

For obvious reasons, many organizations look at the challenges of cyber security as a problem best solved by the IT department. After all, technology is their realm, so they should have to deal with the issues that come with it. Many businesses take this mode of thinking, ensuring certain percentages of the IT budget are specifically spent on security. This certainly isn’t a bad strategy to have, at least to start with. As studies have shown, the more a company spends on IT security, the less chance they’ll be subject to a cyber attack. IT departments usually have the knowledge and expertise to prevent most security breaches, but that doesn’t necessarily mean it’s the most effective way to handle security.

In fact, to truly combat cyber attackers, organizations need to ensure their security strategies have influences outside of IT departments. Every department needs a stake in the security of a company because security threats can and do exist outside of IT. Take bring your own device (BYOD) for example. If a business has adopted a BYOD policy, every worker in the company can use their personal mobile devices for their jobs. This opens up the possibility of security weaknesses spreading across the organization regardless of which department a specific employee works in. By spreading the responsibility of cyber security to the entire company, businesses are placed in a better position to respond to threats.

This dispersal of responsibility still doesn’t answer who should be in charge, though. Most issues as serious as security need one person to lead the effort. For many companies, that person is the Chief Information Security Officer (CISO), and while the CISO usually comes from the IT department, some businesses are changing the functions of the position. The general idea is to turn the CISO into more of an independent role, one that can maneuver between departments and prescribe different solutions that will increase security and prevent future breaches. CISOs normally have a seat on the company board, which also helps them to have the ear of the CEO, who needs to be on board for any significant changes. Some smaller businesses may choose to use consultants in place of the CISO. This third party, or “virtual CISO”, can fulfill certain responsibilities, though they are not a permanent fixture of the organization.

Each of these solutions does come with downsides. Placing the responsibility on IT departments usually leads to too much of reliance on security technology and big data tools (like Apache Spark) to solve problems when they are not needed. Putting a CISO in charge may place too much focus on information security specifically and not other security problems. In either case, a company’s priorities should be placed on making the entirety of the organization responsible. That means spreading security spending around. Of particular note is the need for employees to be aware of the security threats they introduce through their actions. Through awareness training programs, each employee can become responsible for security in his or her own way.

In a sense, no single person should be solely in charge of cyber security. From an organizational standpoint, having one person lead the way makes sense, but employees represent a critical element that may introduce security risks in the workplace. If each employee takes responsibility for cyber security, businesses will be much better off. That also includes the CEO, who needs to take the threat seriously. In other words, companies should not leave the responsibility only to the IT personnel. Everyone has a part to play in making sure they don’t become victims of security breaches.

Read the original blog entry...

More Stories By Bob Gourley

Bob Gourley writes on enterprise IT. He is a founder of Crucial Point and publisher of CTOvision.com

Latest Stories
ICC is a computer systems integrator and server manufacturing company focused on developing products and product appliances to meet a wide range of computational needs for many industries. Their solutions provide benefits across many environments, such as datacenter deployment, HPC, workstations, storage networks and standalone server installations. ICC has been in business for over 23 years and their phenomenal range of clients include multinational corporations, universities, and small busines...
This sixteen (16) hour course provides an introduction to DevOps, the cultural and professional movement that stresses communication, collaboration, integration and automation in order to improve the flow of work between software developers and IT operations professionals. Improved workflows will result in an improved ability to design, develop, deploy and operate software and services faster.
Headquartered in Plainsboro, NJ, Synametrics Technologies has provided IT professionals and computer systems developers since 1997. Based on the success of their initial product offerings (WinSQL and DeltaCopy), the company continues to create and hone innovative products that help its customers get more from their computer applications, databases and infrastructure. To date, over one million users around the world have chosen Synametrics solutions to help power their accelerated business or per...
All in Mobile is a place where we continually maximize their impact by fostering understanding, empathy, insights, creativity and joy. They believe that a truly useful and desirable mobile app doesn't need the brightest idea or the most advanced technology. A great product begins with understanding people. It's easy to think that customers will love your app, but can you justify it? They make sure your final app is something that users truly want and need. The only way to do this is by ...
Authorization of web applications developed in the cloud is a fundamental problem for security, yet companies often build solutions from scratch, which is error prone and impedes time to market. This talk shows developers how they can (instead) build on-top of community-owned projects and frameworks for better security.Whether you build software for enterprises, mobile, or internal microservices, security is important. Standards like SAML, OIDC, and SPIFFE help you solve identity and authenticat...
The digital transformation is real! To adapt, IT professionals need to transform their own skillset to become more multi-dimensional by gaining both depth and breadth of a wide variety of knowledge and competencies. Historically, while IT has been built on a foundation of specialty (or "I" shaped) silos, the DevOps principle of "shifting left" is opening up opportunities for developers, operational staff, security and others to grow their skills portfolio, advance their careers and become "T"-sh...
Digital Transformation and Disruption, Amazon Style - What You Can Learn. Chris Kocher is a co-founder of Grey Heron, a management and strategic marketing consulting firm. He has 25+ years in both strategic and hands-on operating experience helping executives and investors build revenues and shareholder value. He has consulted with over 130 companies on innovating with new business models, product strategies and monetization. Chris has held management positions at HP and Symantec in addition to ...
Whenever a new technology hits the high points of hype, everyone starts talking about it like it will solve all their business problems. Blockchain is one of those technologies. According to Gartner's latest report on the hype cycle of emerging technologies, blockchain has just passed the peak of their hype cycle curve. If you read the news articles about it, one would think it has taken over the technology world. No disruptive technology is without its challenges and potential impediments t...
Hackers took three days to identify and exploit a known vulnerability in Equifax’s web applications. I will share new data that reveals why three days (at most) is the new normal for DevSecOps teams to move new business /security requirements from design into production. This session aims to enlighten DevOps teams, security and development professionals by sharing results from the 4th annual State of the Software Supply Chain Report -- a blend of public and proprietary data with expert researc...
Lori MacVittie is a subject matter expert on emerging technology responsible for outbound evangelism across F5's entire product suite. MacVittie has extensive development and technical architecture experience in both high-tech and enterprise organizations, in addition to network and systems administration expertise. Prior to joining F5, MacVittie was an award-winning technology editor at Network Computing Magazine where she evaluated and tested application-focused technologies including app secu...
DXWorldEXPO LLC announced today that Nutanix has been named "Platinum Sponsor" of CloudEXPO | DevOpsSUMMIT | DXWorldEXPO New York, which will take place November 12-13, 2018 in New York City. Nutanix makes infrastructure invisible, elevating IT to focus on the applications and services that power their business. The Nutanix Enterprise Cloud Platform blends web-scale engineering and consumer-grade design to natively converge server, storage, virtualization and networking into a resilient, softwar...
DXWorldEXPO LLC announced today that Big Data Federation to Exhibit at the 22nd International CloudEXPO, colocated with DevOpsSUMMIT and DXWorldEXPO, November 12-13, 2018 in New York City. Big Data Federation, Inc. develops and applies artificial intelligence to predict financial and economic events that matter. The company uncovers patterns and precise drivers of performance and outcomes with the aid of machine-learning algorithms, big data, and fundamental analysis. Their products are deployed...
Dynatrace is an application performance management software company with products for the information technology departments and digital business owners of medium and large businesses. Building the Future of Monitoring with Artificial Intelligence. Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more busine...
Having been in the web hosting industry since 2002, dhosting has gained a great deal of experience while working on a wide range of projects. This experience has enabled the company to develop our amazing new product, which they are now excited to present! Among dHosting's greatest achievements, they can include the development of their own hosting panel, the building of their fully redundant server system, and the creation of dhHosting's unique product, Dynamic Edge.
This session will provide an introduction to Cloud driven quality and transformation and highlight the key features that comprise it. A perspective on the cloud transformation lifecycle, transformation levers, and transformation framework will be shared. At Cognizant, we have developed a transformation strategy to enable the migration of business critical workloads to cloud environments. The strategy encompasses a set of transformation levers across the cloud transformation lifecycle to enhance ...