RSA, the Security Division of EMC, has released a new research report which explores the link between CEO priorities and information security strategy, examining how a divide between an organisation's CEO and its security officer can detrimentally impact its risk profile and ultimate business success.
As the fifth report in RSA's Security for Business Innovation series, Bridging the CISO-CEO Divide takes an in-depth look at what it takes to garner CEO support for a strategic information security effort. Coupled with that advice are recommendations for what CISOs should not do; taking a candid look at some potentially job-losing ways to alienate your CEO. Perhaps most importantly, the report challenges CEOs to see how their lack of support for strategic information security could unintentionally put their companies at risk.
The report is based on in-depth conversations with the Security for Business Innovation Council, whose members are the top security executives at the world's largest organisations.
“The importance of aligning security investments with the corporate agenda is now well understood,” said Rob Watson, Country Manager of RSA, the Security Division of EMC South Africa. “Yet despite this progress, most security leaders are still struggling to convince their CEOs that security absolutely must be a core component of their business strategy. It's time to get this issue solved, and success will require both CEOs and CISOs to shift how they think, act and run their organisations.”
Report Issues CISO-CEO Call to Action
Bridging the CISO-CEO Gap calls attention to the fact that many of the actions organisations are taking to survive in this economy - like using new technologies and global business models to drive efficiencies - are both innovative and risky. Never before have information security officers been in such a strong position to help their companies take the right risks in the right ways. But, first they must gain the confidence and support of their CEOs. CEOs must also recognise that their company's success in recovering from the economic downturn and thriving in the longer term is dependent on its ability to expertly manage the risks they are taking.
Key recommendations to help security professionals gain CEO support include:
* Establish security champions within the CEO's circle of trust: Win over those who influence or interact with the CEO on a regular basis (the Board and C-level direct reports).
* Set up a clear organisational structure: The security organisation should have an absolutely crystal clear organisational structure. It must be clearly articulated, socialised and institutionalised across the whole enterprise so that people understand what security does just as they understand other more entrenched departments such as accounting and finance.
* Make it real: To help the CEO understand the risk, make it real. As much as possible, CISOs should quantify the risks. Don't just give vague explanations; instead describe realistic scenarios with actual numbers for probabilities, impact and financial losses. Address these within the context of the organisation's market position, vertical industry and regulatory regime.
The report also serves as a wake-up call for CEOs. It underscores the need for CEOs to understand how significantly their actions and attitudes will impact the effort to protect information at their companies. To this end, the Council points out some of the top ways the CEO can unwittingly put the company at risk when it comes to information security, including:
* Setting the wrong tone at the top: If organisational leaders create a culture of apathy towards protecting information, the organisation will do the same. The CEO can set the right tone by actively communicating the strategic importance of this responsibility and establishing shared accountability for the protection of information throughout the organisation.
* Thinking about information security as just a technology or a compliance problem: Information security needs to be viewed as a risk management problem. When the CEO doesn't see the bigger-picture context surrounding security decisions, the company is inevitably exposed to all kinds of other risks.
* Failing to set up proper organisational responsibility: If information security ownership is not established at the appropriate level of seniority within a company, it will not be seen as serious. A role that directly impacts a company's brand, reputation and information assets should have a security leader appointed to it such as a CISO or equivalent.
CISOs and CEOs can measure their progress in strategically aligning security and business via a private ten question interactive tool.
Share
Security for Business Innovation Council
The Security for Business Innovation Council is a group of highly-successful Global 1000 security executives who are committed to sharing their own insights and experiences to help move information security forward at organisations worldwide.
The report released today is the fifth in the series, and RSA expects to publish more original Council reports over the coming months. Those interested in learning more about the Security for Business Innovation Council reports can visit the RSA Thought Leadership website at http://www.RSA.com/securityforinnovation/ to view and download all of the studies.
RSA
RSA, the Security Division of EMC, is the premier provider of security solutions for business acceleration, helping the world's leading organisations succeed by solving their most complex and sensitive security challenges. RSA's information-centric approach to security guards the integrity and confidentiality of information throughout its lifecycle - no matter where it moves, who accesses it or how it is used.
RSA offers industry-leading solutions in identity assurance and access control, data loss prevention, encryption and key management, compliance and security information management and fraud protection. These solutions bring trust to millions of user identities, the transactions that they perform, and the data that is generated. For more information, please visit www.RSA.com and www.EMC.com.
EMC
EMC Corporation (NYSE: EMC) is the world's leading developer and provider of information infrastructure technology and solutions that enable organisations of all sizes to transform the way they compete and create value from their information. Information about EMC's products and services can be found at www.EMC.com.
RSA is either a registered trademark or trademark of RSA Security Inc. in the United States and/or other countries. EMC is a registered trademark of EMC Corporation. All other company and product names may be trademarks of their respective owners.
Editorial contacts