According to a 2015 study by Georgia Tech Information Security Center, 40 percent of CISOs reported to the CIO or CTO rather than directly to upper leadership.1 A forthcoming F5 Ponemon CISO research report will show that the trend is shifting away from CISOs reporting into the IT organization. From a legacy point of view, it made sense to have the CISO under the technology department. Typically, CIOs and CTOs are responsible for maintaining viable and acceptable IT systems for the enterprise. Security is just one of many critical properties that IT systems must always have, so security has fallen under IT. However, this doesn’t provide a real seat at the executive table and thus reduces a CISO’s effectiveness. So, organizations are beginning to see that there is much to be gained from getting a CISO out from under IT. Let’s look at some of the reasons why.
Operational Conflicts
The primary mission of the IT department is to keep things running and implement new IT projects to support the organization; the CISO’s job is to keep IT risk to an acceptable level. These are similar goals but they don’t always align. Sometimes the CISO is the one who must say “no” (or, at least, “slow down”) to some of the riskier new IT projects. For a CISO, it is better to be safe than to be sorry. However, IT can be less risk averse and can be willing to blaze ahead to fulfill a business mission. This can lead to conflicts between pleasing users versus protecting the organization. There are also times when IT may lower the priority of security operational tasks, like patching systems or rolling out multi-factor authentication, which could affect uptime and access. In general, IT cares more about system availability and providing access to resources while Security seeks to restrict access even in favor of uptime. In most cases, in the event of a systems breach, it is the CISO who will take the blame, not the IT department.
You can also run into budget conflicts if Security and IT are drawing from the same well. In a perfect world, every IT system would incur a “security tax” based on the controls required to bring its risk down to acceptable standards. In reality, a new application security system will take a back seat to an SAP upgrade.
Risk
When it comes to information security, some risk decisions and mitigations fall far outside the domain of the IT department, for example, those that involve Facilities security, Human Resources, and the legal department. The security group works with these and other departments at an operational level while IT works primarily with other departments in a supportive role. But, because the scope of risk is often enterprise-wide, some risk decisions need to be made at the executive level. Therefore, the CISO needs to have direct access to high-level decision makers to assist in those decisions. And, while we know that the CIO can operate effectively at the executive level, he or she will not have the same perspective and priority as someone in charge of Security.
Insider Action
One of the jobs of the CISO is to hunt down malicious insiders—and it turns out some of the most dangerous insiders are within the IT group. Sometimes they’re even in charge of IT. A famous case in Seattle in the late 1990s involved the head of IT at a large international law firm perpetrating fraud. To hide her illicit activities, she fired her security consultants and kept her IT staff in the dark.2 Her actions helped bring about the ruin one of the Seattle’s largest and oldest law firms.
We also know that security people can go bad, as well. One way to deal with that is to not give the security team administrative privileges. That way the organization can have checks and balances.
Effectiveness
Sometimes the CISO needs to solve problems without using technology, but rather by revising or updating policies, reworking processes, or providing education. IT primarily solves problems with technology, which may not always be the best security solution.
Just because someone is skilled in IT doesn't mean they fully understand the principles of security and effective practices. A key skill that CISOs and security professionals have is in threat modeling and understanding how attackers operate. Many IT personnel aren’t experienced or trained in understanding this adversarial mindset, and this can lead to misunderstandings when security personnel have to work under IT constraints. Another major area that CISOs understand is compliance and privacy regulations, which are also not ordinary IT disciplines. When Security falls under IT, there is often a lag or a gap in translating these concepts, which can significantly reduce effectiveness.
Regulations
The potential for conflict of interest for CISOs is such a problem that some jurisdictions require CISO independence. For example, in the US, the Sarbanes-Oxley Act (SOX) regulates the integrity of financial records for public companies to protect investors. SOX audits can and have cited CISO reporting structure as a control design weakness under the Separation of Duty requirement.
For organizations holding or processing data pertaining to EU citizens, they must adhere to the European General Data Protection Regulation (GDPR) by May 25, 2018. GDPR requires appointing a Data Protection Officer (DPO) when the business activities involve processing large scale or sensitive data (such as health data or criminal records).
GDPR is a consolidation and refinement of existing data protection laws of European Member States. One of those existing laws is the German Federal Data Protection Act (FDPA). The FDPA states that the DPO must not have other duties which conflict with the monitoring obligations of the DPO under the FDPA.3 It's likely that the intent of this law will be reflected in some way in GDPR.
In addition, Israel's Privacy Protection Regulations state that a CISO must report directly to senior management as well be independent, free of conflicts, and be sufficiently resourced.4
Conclusion
Some organizations have made half steps towards CISO independence by adopting “dotted line” reporting structures where the CISO reports both to the head of IT as well as another executive such as the Chief Operating Officer. As time goes on, I expect more CISOs to move out from under IT, especially as the importance of cyber security becomes more critical.
