The Changing Role Of The CISO?

Just a few years ago, the chief information security officer's focus was to defend business-technology systems from the continuous barrage of viruses, worms, denials-of-service, and many other types of attacks that placed system availability and information at risk. For many, I suspect, this role has changed dramatically.It all started with the high-profile cases of corporate fraud, increases in identity theft, transaction fraud, and breaches of personally identifiable financial information. These ushered in a tsunami of state, federal, and industry regulations that purport to reduce corporate fraud and secure electronic information.

And yet we still have insider frauds the likes of the SocGen fraud and breaches like the TJX fiasco. But I digress.

All of these government and industry regulatory pressures affect nearly every organization. From Sarbanes-Oxley, which governs the accounting information of publicly traded companies, to the California Security Breach Information Act (SB 1386), which aims to give consumers adequate notice whenever specific financial account information is breached. As well as the final security rules for the Health Insurance Portability and Accountability Act (HIPAA). And then there's the credit card industry's PCI Data Security Standard that touches nearly every retailer.

I'm sure I'm forgetting a few dozen new regulations, or mandates. So where do organizations turn when they need all of the new policies and procedures in place to ensure these rules are enforced throughout their organization? Usually, it's the CISO.

So how has this changed the day-to-day life of the chief information security officer? Are you spending more time designing strategies to successfully answer an auditor's checklist? Or, are you working to ensure all of the custom applications designed in your organization are developed securely?

Are you trying to figure out more cost-effective ways to manage the barrage of internal controls your company has recently put into effect to grapple with Sarbanes-Oxley; or are you making sure each and every employee has the training they need keep their endpoints safe?

Let us know where the bulk of your attention goes nowadays. Is it combating regulatory mandates, or security threats?