Risky Business

What is at risk? Everything. People, information, machinery, software, hardware, intellectual property, customer privacy, buildings, the company jet, the organisation's brand, its reputation, the air-conditioning - even the water supply. Such is the delicate nature of security matters for our large corporates that the recently appointed CSOs of Sydney Water and Telstra declined to speak with CIO. An Australian-based CSO who would speak requested anonymity. It's easy to see why.

"Corporate security remains an immature, inexact science, he says, "in which neither the physical security or IS professionals have sold themselves as practitioners of a strategic function.

"As a result, there is a lot of tactical and operational effort occurring that provides organisations all over the world with a level of comfort. As long as people see money being spent, they'll think they must be doing something useful. The reality is that we have really only scratched the surface of understanding enterprise security and we are a long, long way from being able to manage it."

Dean Kingsley, the head of enterprise risk services Asia-Pacific at Deloitte Consulting, says the Bali bombing and Australia's close allegiance to Britain and the US has changed forever the risk profile of Australian organisations - public and private. He says many have responded by focusing on physical security after promoting IS [security]during the dotcom years. But Kingsley sees a time, fast approaching, when the disciplines will be one.

"In the case of Telstra and Sydney Water they would probably say they have got there already," Kingsley says. "But they're the exception rather than the rule. Their senior security people come from a physical security background. They would have needed to upskill on IS. It will be interesting to see when we get the first examples of an IS professional taking over physical security responsibilities."

Kingsley believes there is little mutual understanding between the physical and IS communities. IS professionals typically come from an IT background. People in physical security roles come mostly from law enforcement or some variant like the military. Their DNA is different. Giga says IT security staff often think they are inventing security measures, unaware that corporate security is rooted in hundreds of years of public safety know-how.

"There is a segment of the IS industry that comes from the intelligence community and that has some crossover with the guns and bombs crowd," Kingsley says. "You're dealing with ex-cops on one side and ex-computer geeks on the other. They don't have a lot in common - no shared vocabulary and no shared view on life. They have very different ways of thinking."