Turf Wars

Mark Ames began his career in information security as a "cold warrior" with the US National Security Agency (NSA) in West Berlin. He has extensive policy, technology and risk management experience through his work as a security manager for several large firms and as CTO of TruSecure Asia-Pacific. Ames chairs the board of the Information Security Research Centre at the Queensland University of Technology. He also chairs the Information Security Interest Group in Australia, sits on the Standards Australia Committee for Information Security and consults to many companies and governments though his company, ICT Risk.

"The trend I see is that organisations have someone - and this is often a new position - looking after operational risk," Ames says. "This used to live with the CFO's office but more and more it's with the risk management executive.

If the company is big enough to do international business the first thing this person will manage is currency risk, then product liability, insurances, OH&S, public liability, handling the media, etc. And creeping up on all this is IT, which is now a major component of operational risk. It gets the same attention shown to managing people, raw materials, stock, the manufacturing process, intellectual property, finances, etc. It's right up there with the 'big rocks'," Ames says.

"I've had discussions with colleagues from the physical security side and from the IS side and there seems to be a fight for who will get the territory. The physical security people seem really keen to latch onto it since traditionally, their role has not been high up the food chain."

Ajoy Ghosh is an independent consultant who also lectures in cybercrime at the University of Technology, Sydney. He is a former NSW police investigator and manager of IT security assessments & investigation for Westpac. Ghosh says there are two things driving the importance of IS security: the recognition that security is no longer about protecting technology but about protecting the brand; and the personal liability now faced by company directors who know that catastrophes can hurt their own pockets or land them in gaol. Suddenly, an executive to manage security is a sound investment.

"This person is way past managing firewalls or responding to incidents," says Ghosh. "They set strategy and establish sound security governance across the company. They'll come from a diverse range of backgrounds and have diverse skill sets, but what stands them apart is their abilities to promote the notion of security in-house and to rapidly collect and understand information about their organisation."

Ames says executive management committees will seek in a CSO what they sort from CIOs when they reached the big table - plain-English explanations of complex concepts, detailed reasons why security is important and fiscally sound arguments as to why it should attract investment.

"Picture a CSO asking a board of directors to imagine their company's manufacturing database - the one that organises all the jobs and runs all the machines - being out of action for half a day," he says. "That's when they begin to realise the impact. But it's still very much an educational process, even if you get past this obstacle.