|Main Archive Page > Month Archives > infosec-news archives|
By Kelly Jackson Higgins
Feb 02, 2011
A sign of the times for the chief security officer (CSO): In some
organizations, CSOs now report either directly to the CEO, board of
directors, chief financial officer, or legal and risk assessment groups.
It should come as no surprise that the CSO's job description is changing
as security has gradually gained a higher profile on the business side
-- mostly thanks to well-publicized and massive data breaches on brand
names during the past two years and related regulatory pressures.
Technical acumen is now just one skill requirement for the CSO, and he
or she is no longer a part of only the IT department reporting to the
chief information officer (CIO).
Take Experian CSO Stephen Scharf, who reports to his company's global
general counsel. In his previous stint as CSO at Bloomberg, his direct
report line was to the chairman of the board. "As the role has evolved,
the reporting line is moving away from CIO. I have seen other companies
with CEO, CFO, and COO reporting lines," says Scharf, 38, who was not
speaking on behalf of Experian. "The baseline skill set was technical
only" when the CSO position first emerged, he says. "Now I feel that
it's the minimum requirement, but still necessary. There's a lot more
required on the risk management side, the compliance aspect, government
affairs, and legal. I see information security as just being a silo now
that it is going to migrate to a larger risk management framework."
Scharf, along with CSOs from Kaiser Permanente and Royal Ahold, will
speak during a professional development seminar at the upcoming RSA
Conference that will include a look at the issues facing the CSO, as
well as the CSO's future job description. "The concept that 'I'm a CSSP
and therefore must be qualified'" for a CSO position is no longer valid,
says Lee Kushner, president of LJ Kushner & Associates, who will discuss
the CSO's new job description during the seminar.
Tegatai Managed Colocation: Four Provider Blended
Tier-1 Bandwidth, Fortinet Universal Threat Management,
Natural Disaster Avoidance, Always-On Power Delivery
Network, Cisco Switches, SAS 70 Type II Datacenter.
Find peace of mind, Defend your Critical Infrastructure.