CIOs And Security: Time To Rethink The Processes?
7 Bold Tech Ideas That Will Make You Uncomfortable
(Click image for larger view and slideshow.)
Target, Home Depot, and Sony have demonstrated how vulnerable businesses are to catastrophic data breaches. The ripple effects from massive strikes reverberated through these organizations, causing millions of dollars in damage.
Despite the headlines, most firms are not equipped to respond to such problems. However, a new, nuanced way of dealing with security threats is required, and IT is in a good position to lead this corporate transformation.
Here's how the new security paradigm is shaping up.
First, IT needs to recognize that the traditional methods of dealing with security breaches are not enough to effectively respond to the massive break-ins. "Companies are under attack every day," said Bill Stewart, executive VP at Booz Allen and leader of the firm's commercial cyber-business, which in April issued a report titled "Emerging Trends: Big Changes in Cyber Risk, Detection, Improved Incident Response."
Enterprises have put security solutions and business processes in place to deal with most threats. Systems are constantly probed, and tools like firewalls are sufficient to ward off many attacks.
But recently, the crooks have done a better job of skirting traditional system security, unlocking sensitive information, and stealing millions of records. These high-profile break-ins require more than patching a software flaw and blocking the hacker from the network. They demand a coordinated, multi-tiered, company-wide response -- one emanating from the boardroom and touching upon many departments.
Enterprises must change their security outlook from being an IT-only issue to a corporate concern.
Everyone Working Together
To be successful, a business needs unprecedented levels of cooperation among different departments and a proactive, top-management-involved approach to dealing with security threats. The enterprise needs to form a cyber-crisis management team, a group that deals only with high-level threats.
(Image: texelart/iStockphoto)
"If a company waits until it's in crisis, time is spent trying to figure out who is in charge, rather than actually responding to the breach," said Dan Blum, principal consultant with Security Architects, a security consulting firm.
Because the group touches upon so many departments, the CIO is not the best person to chair the committee. Booz Allen's Stewart recommends that the chief operating officer (COO) run the committee, because far-reaching decisions are made within it.
"Shutting down mission-critical applications is on the table whenever businesses discover a major breach," explained Booz Allen's Stewart. Taking an online store offline on Black Friday is clearly a CEO- and board-level decision.
The CIO is likely to spearhead the group's formation since that role has the keenest insight into the challenges that the new massive threats represent.