Careers & People
10/19/2016
03:35 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

CIO-CISO Relationship Continues To Evolve

The CISO has traditionally reported to the CIO, but this is changing as security becomes more important. How will this change their relationship, and how can they better work together?

For years, the security pro was one of many staffers under CIO management. Now the CISO is becoming more prominent as businesses buckle down on security.

This is causing a shift in the working relationship between the two C-level executives. While the CIO is responsible for leadership, vision, and IT implementation to propel the business forward, the CISO has a critical role in providing insight and guidance to ensure the strategy is secure.

"The CISO role is becoming more important in the relationship with the CIO," says Dave Mahon, VP and CSO at CenturyLink. "Security is now, in essence, table stakes for delivering on your corporate strategy." 

Part of this is due to the evolution of security. Corporate networks are increasingly complex and support more connected devices than ever, especially with the growth of BYOD programs. Hackers are using more sophisticated methods to breach organizations and steal data.

In this dynamic environment, the CISO identifies vulnerabilities and advises the CIO on future plans, Mahon explains. The two review a road map, look at systems and data throughout the organization, and the CISO provides guidance. For example, he/she may advise the CIO not to use a particular vendor because it's a security risk.

"There is no corporate structure standard but today, the majority of public companies still have the CISO reporting directly to the CIO," says Jeremy King, president at Benchmark Executive Search.

Every company views risk management differently, he continues. Some businesses have their CISO report to the general counsel, head of compliance, COO, or CEO. In addition, the CISO and CIO are becoming more empowered to veto key strategic decisions.

"The CISO has a seat at the boardroom table," says Dawn-Marie Hutchinson, executive director for Optiv's Office of the CISO. "They're saying, 'Let's talk about what the business is doing strategically and how we can enable that functionality.'"

This used to be the CIO's conversation, she says, but reporting structure is changing to prioritize security issues and projects. Businesses want to know how they can maintain the privacy of information systems, and the attention is giving CISOs more face time with board members and execs.

Greg Conti, principal at IronNet Cybersecurity, says he foresees the requirements for CISOs increasing over time, especially as more highly publicized breaches continue to occur.

"The CISO must understand technology, policy, law, compliance, risk, and myriad other areas," he explains. "These are very diverse topics and this complexity requires a strong team because no one can be an expert in it all."

As the CISO becomes critical to business decisions, the CIO's role is changing, says Hutchinson. The CIO is more frequently being relegated to operational tech and handling issues like outsourcing, cloud usage, and network availability -- all issues driving them away from security.

Change and Challenges

Going forward, both the CIO and CISO will face distinct challenges as their roles and relationship continue to evolve.

The role of the CIO won't go away, says Hutchinson, but it will be redefined as we know it. She predicts the CIO will have greater responsibility over innovation. Companies that innovate are those with strong CIOs leading the charge, she notes.

The challenge for CIOs will be deploying new technologies. Oftentimes they're so preoccupied with keeping the lights on, CIOs don't have time to make the IT department more effective in providing and supporting tools that meet changing business needs, she says.

Mahon poses another question that will challenge CIOs and CISOs as the threat landscape evolves: "One of the challenges will be, how do you meet the addressable market, the needs of customers, in a way that still aligns with your own corporate-approved risk management posture?" 

This question will require senior leadership teams that establish the risk management posture to strike a balance between speed-to-market and security. They can choose to go to market quickly, but in doing so, they risk long-term repercussions.

The changing roles of the CISO and CIO may affect spending, says Conti.

"I do see the CIO's role as being potentially less glamorous than that of the CISO in some ways," he notes. "For example, the classic challenge of the CIO is what when everything is working nobody cares, but as soon as something stops working, it becomes a major problem. This challenge is hard to overcome, whereas the CISO has a compelling security narrative driving their requirements."

Related Content:

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance & Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
10/22/2016 | 4:20:06 PM
e.g., DHHS
Indeed, the CISO of the US Department of Health and Human Services will no longer report to the CIO because of conflict of interest issues; I'm proud to have written an InformationWeek piece that was cited in a legislative report recommending having the DHHS CISO report to the DHHS General Counsel.

Legislative report: energycommerce.house.gov/sites/republicans.energycommerce.house.gov/files/114/Analysis/20150806HHSinformationsecurityreport.pdf

IWK piece: informationweek.com/strategic-cio/cyber-security-and-the-cio-changing-the-conversation/a/d-id/1320660
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.