Helicopter View

While AMP and PowerTel effectively separate IT security from their organisations' physical and overall security strategy and management, KPMG Australia's 2001 Security Strategies report states that the security function should strategically oversee security risk management across the entire organisation. To be effective, the report says, the security group requires a strong presence and visibility and a strong authority mandate to take action. To ensure this, it must sit no lower than two levels below the chief executive, although corporate governance should place ultimate responsibility for security with the board.

According to the KPMG report, the concept of a"security council" comprising key members of business, security and IT is also becoming popular. The council serves as a forum to raise and agree security initiatives and strategies and can enable active business participation in the security process, it says.

To some degree, this is the way Corporate Express Australia operates. CIO Garry Whatley says he is ultimately responsibility for IT security, although a technical architect/security officer, who reports to Whatley, handles day-to-day security matters along with other duties."We're going through the TruSecure accreditation process and he [the security officer] is a highly technical person with the detailed skills to make sure all the proper security procedures are in place," Whatley says.

Corporate Express Australia also has a security committee, headed up by Whatley and comprising senior executives such as the financial controller, risk manager and company secretary. For while security has gained a higher profile in some circles in the past year, according to Whatley, it has always been ongoing for Corporate Express.

In particular, as one of Australia's largest single source suppliers of office goods and services, the company has been conducting business on the Internet for a relatively long period and derives a significant proportion of its revenue through online sales."That has raised [the issue of] security pretty high because we speak to people like the Department of Defence, for whom security is paramount. So we need to prove internally that we have all the right processes in place," Whatley says.

SIDEBAR: The Security Executive's To-Do List.

1. Merge physical and IT security organisations.

2. Have asset owners identify critical assets, determine their value and participate in risk assessments.

3. Audit security early and often.

4. Demand background checks and psychological profiling for sensitive staff.

5. Evaluate business partners' security.

Source: Forrester Research