[ISN] CSOs At A Crossroads

http://www.darkreading.com/security/security-management/229200293/csos-at-a-crossroads.html

By Kelly Jackson Higgins
Darkreading
Feb 02, 2011 

A sign of the times for the chief security officer (CSO): In some 
organizations, CSOs now report either directly to the CEO, board of 
directors, chief financial officer, or legal and risk assessment groups.

It should come as no surprise that the CSO's job description is changing 
as security has gradually gained a higher profile on the business side 
-- mostly thanks to well-publicized and massive data breaches on brand 
names during the past two years and related regulatory pressures. 
Technical acumen is now just one skill requirement for the CSO, and he 
or she is no longer a part of only the IT department reporting to the 
chief information officer (CIO).

Take Experian CSO Stephen Scharf, who reports to his company's global 
general counsel. In his previous stint as CSO at Bloomberg, his direct 
report line was to the chairman of the board. "As the role has evolved, 
the reporting line is moving away from CIO. I have seen other companies 
with CEO, CFO, and COO reporting lines," says Scharf, 38, who was not 
speaking on behalf of Experian. "The baseline skill set was technical 
only" when the CSO position first emerged, he says. "Now I feel that 
it's the minimum requirement, but still necessary. There's a lot more 
required on the risk management side, the compliance aspect, government 
affairs, and legal. I see information security as just being a silo now 
that it is going to migrate to a larger risk management framework."

Scharf, along with CSOs from Kaiser Permanente and Royal Ahold, will 
speak during a professional development seminar at the upcoming RSA 
Conference that will include a look at the issues facing the CSO, as 
well as the CSO's future job description. "The concept that 'I'm a CSSP 
and therefore must be qualified'" for a CSO position is no longer valid, 
says Lee Kushner, president of LJ Kushner & Associates, who will discuss 
the CSO's new job description during the seminar.

[...]


___________________________________________________________      
Tegatai Managed Colocation: Four Provider Blended
Tier-1 Bandwidth, Fortinet Universal Threat Management,
Natural Disaster Avoidance, Always-On Power Delivery 
Network, Cisco Switches, SAS 70 Type II Datacenter. 
Find peace of mind, Defend your Critical Infrastructure.
http://www.tegataiphoenix.com/