This makes Darren O'Loughlin rather unique. He's a computer geek and an ex-cop. Now the director of IT security at Ernst & Young, O'Loughlin is a former Victoria Police Force detective who spent years in its Computer Crime Investigation Squad. He was responsible for the design and management of the squad's secure internal networks and its covert Internet investigations. His experience includes network security, computer forensics, incident response, systems development, strategic planning and disaster recovery. O'Loughlin is convinced the worlds of physical security and IS are merging.

"We have reviewed the information security operations at many different companies and the ones that are really successful demonstrate six characteristics, one of which is a strict adherence to physical security disciplines," O'Loughlin says. "It goes back to the adage that you are only as strong as your weakest link. Many sophisticated IT security matters depend on mundane physical security controls. For example, making sure that only people with the appropriate authority have access to certain systems.

"To me, merging physical and IT security functions is a natural process. But while both disciplines are aligning, we're also seeing the enterprise risk management strategy function splitting from day-to-day security operations. That's because security now requires a strong voice at a senior level - a person who doesn't have time to worry about fire extinguishers, ID passes or the lifts."

Security advisers like Hunt, Kingsley and O'Loughlin say different kinds of threats demand different kinds of management and specific knowledge.

"How do you protect a person against kidnapping or a facility against bombing as opposed to protecting a system against hacking?" says Kingsley. "Clearly, at operational level, you need different competencies. But when you go to a level above that, where the job is to understand and manage risk, make cost-benefit decisions on behalf of the organisation and gather intelligence on where threats are most likely to manifest, it's the same discipline.

"Between the two communities we've got the spectrum of security needs covered, but because they are not well coordinated you won't find many people who can do both," he says. "If you found a great IS manager they would understand the broad nature of their threat environment, how to quantify risk, how to put together a compelling ROI case or how to invest in counter-measures. But they wouldn't know how that translates to the physical environment.

"Much of the gap between IS and corporate security is as much about vocabulary as it is knowledge. Both know more than they think about the other's job. But the language in each is so unique that a mystique is built up in both fields that make each feel exclusive. One of the challenges is to get them cross-pollinating in order to create CSOs who can straddle both worlds credibly."