Operational Conflicts

The primary mission of the IT department is to keep things running and implement new IT projects to support the organization; the CISO’s job is to keep IT risk to an acceptable level. These are similar goals but they don’t always align. Sometimes the CISO is the one who must say “no” (or, at least, “slow down”) to some of the riskier new IT projects. For a CISO, it is better to be safe than to be sorry. However, IT can be less risk averse and can be willing to blaze ahead to fulfill a business mission. This can lead to conflicts between pleasing users versus protecting the organization. There are also times when IT may lower the priority of security operational tasks, like patching systems or rolling out multi-factor authentication, which could affect uptime and access. In general, IT cares more about system availability and providing access to resources while Security seeks to restrict access even in favor of uptime. In most cases, in the event of a systems breach, it is the CISO who will take the blame, not the IT department.

You can also run into budget conflicts if Security and IT are drawing from the same well. In a perfect world, every IT system would incur a “security tax” based on the controls required to bring its risk down to acceptable standards. In reality, a new application security system will take a back seat to an SAP upgrade.

Risk

When it comes to information security, some risk decisions and mitigations fall far outside the domain of the IT department, for example, those that involve Facilities security, Human Resources, and the legal department. The security group works with these and other departments at an operational level while IT works primarily with other departments in a supportive role. But, because the scope of risk is often enterprise-wide, some risk decisions need to be made at the executive level. Therefore, the CISO needs to have direct access to high-level decision makers to assist in those decisions. And, while we know that the CIO can operate effectively at the executive level, he or she will not have the same perspective and priority as someone in charge of Security.

Insider Action

We also know that security people can go bad, as well. One way to deal with that is to not give the security team administrative privileges. That way the organization can have checks and balances.

Effectiveness

Sometimes the CISO needs to solve problems without using technology, but rather by revising or updating policies, reworking processes, or providing education. IT primarily solves problems with technology, which may not always be the best security solution.

Just because someone is skilled in IT doesn’t mean they fully understand the principles of security and effective practices. A key skill that CISOs and security professionals have is in threat modeling and understanding how attackers operate. Many IT personnel aren’t experienced or trained in understanding this adversarial mindset, and this can lead to misunderstandings when security personnel have to work under IT constraints. Another major area that CISOs understand is compliance and privacy regulations, which are also not ordinary IT disciplines. When Security falls under IT, there is often a lag or a gap in translating these concepts, which can significantly reduce effectiveness.

Regulations

The potential for conflict of interest for CISOs is such a problem that some jurisdictions require CISO independence. For example, in the US, the Sarbanes-Oxley Act (SOX) regulates the integrity of financial records for public companies to protect investors. SOX audits can and have cited CISO reporting structure as a control design weakness under the Separation of Duty requirement.

For organizations holding or processing data pertaining to EU citizens, they must adhere to the European General Data Protection Regulation (GDPR) by May 25, 2018. GDPR requires appointing a Data Protection Officer (DPO) when the business activities involve processing large scale or sensitive data (such as health data or criminal records).

Conclusion

Some organizations have made half steps towards CISO independence by adopting “dotted line” reporting structures where the CISO reports both to the head of IT as well as another executive such as the Chief Operating Officer. As time goes on, I expect more CISOs to move out from under IT, especially as the importance of cyber security becomes more critical.