The rise of the CSO: Security invades upper-level management

As chief security officer (CSO) of Portland, Maine-based electronic payment provider Clareon, Frank Jaffe is responsible for everything from deciding which security products to buy, to making sure users' passwords are strong enough.

"My job is not a technical job, though I deal with a lot of technology. I have a more business-practice role," said Jaffe.

Jaffe sees his role as fostering a corporate environment that values security. For example, he holds yearly security training sessions that are mandatory -- even for the CEO.

Jaffe also has a monthly contest pitting his Unix administrators against his Windows administrators to see who has the more secure systems. "What they get out of it is bragging rights, which is a big reward," he said.

Jaffe also uses cracking tools to periodically check the security of employee passwords. If an employee has three weak passwords in a row, they are assigned a new password. "They know they won't like the password I assign them," Jaffe said.

A few years ago, a position like Jaffe's would have been unusual. Today, however, more than 200 companies have chief security officers according to analyst firm Giga Information Group in Cambridge, Mass. While the title shows businesses' increased awareness toward security issues, some may question the need to appoint a CSO. After all, shouldn't the CIO handle security?

Experts say it may be unfair to expect CIOs to shoulder all the weight of security matters.

CIOs tend to know how to create great networks and other infrastructure, but security is probably not their forte, said Sondra Schneider, CEO and founder of Security University, a security training company in Stamford, Conn. "They can build a great house, but they aren't too familiar with locks and home security systems," she said.

In many companies, security is delegated to someone at a lower level. Yet the same executives offloading these responsibilities wouldn't think twice about spending their

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT ARCHIVE: IT Career Expert SearchVB wants your tips Pondering MCAD exam changes How to ask for a raise -- and not get fired Experts: network jobs, pay on upswing heading into '05 Breaking into the IT field with little experience When is it time to get out of tech? Resume services: Are they worth the money? Advanced job interview techniques for IT pros Does job security for security technology jobs exist? Sharpening up your soft skills .NET job advice Microsoft expands 'How Do I' video tutorial series Survey: Time, money often drive choices for Microsoft developers Cash in on Visual Studio 2005 e-learning discounts SearchVB.com podcast: What readers said about the state of VB SearchVB.com survey: VB .NET making progress, but VB 6 still No. 1 VB.NET News: Upgrading VB skills, more Visual Basic programming: Second class no more Microsoft offers self-assessments for Visual Studio.NET VS2005 has launched. Now what? With VB growing, it's time to specialize

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

energies, say, evaluating insurance -- a practice similar in importance to security, Schneider said.

For companies who choose to have a CSO, there is a lot of variation in how that person fits into the corporate hierarchy. Generally, CSOs tend to report to the CIO. Yet in some companies, the CSO is in the upper echelon of management -- on par with the CTO and CIO.

Some companies have adopted other monikers for the position:

Additionally, an existing high-level executive can wear the CSO hat along with his or her other titles.

For example, Dave Juitt is both the CTO and the chief security architect of Burlington, Mass.-based Bluesocket, which specializes in securing wireless local area networks. His duties range from supervising security training of personnel to explaining security issues to the board of directors.

Juitt is bilingual in both the language of technology and of business. He can talk about firewalls and intrusion-detection systems with his network people, but he can also discuss how security impacts business needs with the company's board of directors. His job, however, is not to get lost in the technology but to see how it will help the company achieve its business goals.

"You can have the best technology in the world but without education, policy and ongoing testing, you haven't even started," Juitt said.

There's no escaping the fact that having a CSO (or similar position) holds some public relations value for a company. It tells prospective clients or customers that the company is serious about security. Juitt, however, sees this sort of thinking as short-lived.

Over time, people will start to see security as part of business and expect it much like quality and assurance, Juitt said. "There is not a lot of public relations value in a QA department. [Yet,] you are expected to have one," he said.