Current Research on Leadership Development Trust, technology adoption, and insider threat

This paper I will first address the basics of online trust, what increases or decreases trust levels. Next I explore why some users choose to adopt certainly technologies, and the role trust plays in those technologies. This includes trust of users to information systems, and trust of users to other users using the information system. Finally, I discuss the relationship between trust and malicious insiders, as we soon discover organizations can be too trusting of their employees and they may abuse information available to them. Motivated by revenge or financial gain, trusted users may commit fraud, sabotage, or information theft.

Trust
First we discuss the basis of trust in a virtual environment, such as establishing trust between virtual teams and working groups. As we discussed in my last paper, Giddens argues that trust is a stabilizing characteristic to provide reassurance in an uncertain society. (Giddens, 1991) The core of this paper discusses how we come with trust in an online environment, and trust other users to behave in an appropriate manner.

Corritore’s Online Trust Model
Corritore, et al. proposes a model of online trust which exists as a construct of external factors and the perception of external factors. This model is built up from an understanding of previous trust models, both in online and offline trust relationships, and provides a definition of online trust, which proves helpful to understand the specific scope of this paper and its focus. Specifically, trust in an online environment is not trustworthiness, faith, cooperation, or credibility. All these are factors that may contribute to trust, but they are not trust in themselves. Rather, online trust is composed of risk, vulnerability, expectation, confidence, and no exploitation. (Corritore, Kracher, & Wiedenbeck, 2003) They state “Trust encompasses the perception that a person has vulnerabilities and that those vulnerabilities could be breached or capitalized on.”

Corritore, et al. specifically provides a definition of online trust as: “An attitude of confident expectation in an online situation of risk that one’s vulnerabilities will not be exploited.” (2003) They provide an analogy between online and offline trust by creating four dimensions of online trust:
Generality exists as the trustor shifts from general to specific trust. General trust exists when you have overall trust in a person, thing, or website, while specific trust is reliant on a specific characteristic of the trustee, such as a specialist physician or a government website.
Kinds of trust include “slow and swift” trust and “cognitive and emotional” trust. An online example of cognitive and emotional trust is a website that appeals to both the user aesthetically and provides valuable information or services.
Degrees of trust are a progression in depth of trust, starting out weak and growing stronger as degrees of trust progress. These include Basic Trust, Guarded Trust, and Extended Trust.
Stages of trust describe a growth of trust, including Deterrence Based, Knowledge Based, and Shared Identification Based trust.
Each of these dimensions includes factors that differentiate between online and offline trust, but allows the research to draw conclusions from either. (Corritore, Kracher, & Wiedenbeck, 2003)

Quite a bit of research has been created in the realm of Human Computer Interactions (HCI), from website design to error messages, and many relate to establishing trust with a user. Errors in a website, just as by a company or a person, over time will degrade trust with the user. Interestingly, multiple small errors over time may have more of an impact to degrade trust rather than a few large errors. Corritore calls these “Trust Cues”, and are used to build trust factors both online and offline, crossing the boundary between domains. From website design to recommender systems, typographical errors to transaction ratings, a multitude of trust cues affect the creation or destruction of trust, to encourage or discourage the trustor from trusting. (Corritore, Kracher, & Wiedenbeck, 2003)

These theories are summarized in a model of on-line trust, which is made up of two factors of trust, external and perceived. This is described in figure 1, which shows the relationship and generation of online trust. External factors include aspects of the environment, psychological and physical, which contribute to trust. In the online model, this may be website design, features, accuracy, and seals of approval. However, online trust is a perceived experience, and perceived factors in this model are website credibility, ease of use, and risk. (Corritore, Kracher, & Wiedenbeck, 2003)

Credibility and the perception of credibility has four components: Honesty, Expertise, Predictability, and Reputation. Corritore, et al. cites researchers that described honesty as synonymous with trustworthy, and expertise is competency or knowledge. Predictability is related to credibility, that a website will behave as expected. Reputation is also related to credibility, in the factor of a website’s past performance. (Corritore, Kracher, & Wiedenbeck, 2003)

Ease of Use describes how well users can achieve their goals while using a computer, as a mechanism to measure technology adoption. This will be discussed further as website usability is a core component of the Technology Acceptance Model (TAM) (Davis, 1989). In addition, one of the factors contributing to Robert Hanssen’s ability to commit espionage was difficulty using security mechanisms available in the FBI’s Automated Case system. (Band et al., 2006) Corritore relates Ease of Use to TAM in the argument that a website that is easy to navigate and find the information needed instills a sense of trust in the user, and satisfies the user with their online experience. The relationship of Ease of Use to the Technology Acceptance Model applies directly to the relationship between insider threat and trust. (Corritore, Kracher, & Wiedenbeck, 2003)

Risk, both in online and offline dimensions, is the likelihood of an undesirable outcome. A user’s perception of risk is closely linked to their trust. For example, a person buying a large ticket item online for the first time may feel they have little control over the transaction. Komiak & Benbasat argue that while consumers may not be fully aware of all the unknown risks, they have an “awareness of the unknown” that increases their perceived risk. (2004) However, Corritore, et al. argues their level of control is the same as a person who makes purchases all day long online, but their level of perceived risk is much lower. (2003) An exploration of perceived risk will be discussed later in technology adoption and trust, and insider threat and the trust trap.

Chopra and Wallace Online Trust Framework
To enable a strong discussion of trust in information systems, Chopra and Wallace propose a framework to evaluate trust in various domains in electronic environments. The four electronic environments include:
Information
Information systems
e-commerce
Online Relationships

During my last paper I discussed how trust is a human activity, from interpersonal trust to team trust to societal trust. Chopra and Wallace extend this discussion by addressing the difference between trust in a person and trust in an information system, in that information systems can not possess the qualities necessary of a social actor to trust. Trust in its nature requires an inherent quality of transformation due to influence on attitude and behavior, which a computer can not perform. (Chopra & Wallace, 2003)

Their model of trust is captured in Figure 2, which is a sliding scale of interpersonal relationships, from least personal on the left to more personal on the right. Important to note is how the scale shifts from trusting technology to trusting people through technology.

Trust in Technology
Trust in technology follows an interpersonal model of trust. In this case the trustee, or item being trusted, is a web page or electronic document. The information is trusted if it is believed to be reliable, and the trustor enters the relationship willingly, meaning they can accept or reject the information on the document.

Chopra and Wallace (2003) propose trust in information systems has two perspectives, interpersonal trust for specific systems, and societal trust for large networks, such as enterprise information systems. This follows the distinction I make in my last paper, where Eisenstadt, Luhmann, and Pettit discuss interpersonal trust, while Fukuyama, Gibson, Seligman and Urban discuss societal trust. Chopra and Wallace also make the distinction that trust in information is not the same type of trust as interpersonal trust, but a trust in the “proper functioning of computer hardware and software”. (Chopra & Wallace, 2003, p. 7) This is the foundation of Trusted Computing, and is an important distinction between Trusted Computing and interpersonal trust using information systems.

Trust in People
Trust in electronic commerce shifts the discussion closer to humanistic trust, where the trustee is now a person or organization, rather than an information system. In this case an individual’s confidence is that a transaction will be fulfilled appropriately. A number of mechanisms exist to increase the trust in electronic commerce, such as history, buyer and seller rating systems, branding, and predictability.

Finally Chopra and Wallace (2003) identify trust in online relationships. This type of trust closely follows the interpersonal model of trust. (Chopra & Wallace, 2003, p. 8) This situation may be a person engaged in a chat room, bulletin board, email, or other electronic communication resource for sharing information. The element of confidence is the other party will maintain the quality of the relationship. Cognitive trust is influenced by their credentials, while affective trust is created through an emotional bond.

Confidence in an online relationship derives from the other party’s intelligence, and their positive intentions are derived from their actions, such as the propensity to commit fraud, espionage, or mishandle the information. This relates directly to insider threats, discussed later in this paper. Ethics, predictability, dependability, and confidentially are summarily addressed. This definition of confidence is the same we used to define trust earlier. (Corritore, Kracher, & Wiedenbeck, 2003)

The propensity for an individual to trust an online relationship is driven by their technical savvy, and their disposition to trust. Trust in online relationships grow in a similar manner to real-world relationships, where it grows stronger based on previous interactions. Bonding occurs as the relationship evolves into friendship or romance. This follows to the Technology Acceptance Model, discussed later in this paper, where users with more comfort in technology are more likely to adopt technology. (Hsi-Peng, Chin-Lung, & Hsiu-Ying, 2005)

Chopra and Wallace (2003) conclude their discussion with a comprehensive framework. Their seven descriptions of trust are Nature, Elements, Preconditions, Dimensions, Trustworthiness, Influences, and Processes. Specific to our discussion of online trust, this framework demonstrates online relationship models closely follow the real-world trust relationship models. The context of trust is derived from the situation, the societal role of trust comes from introductions and referrals, and interpersonal trust relies on confidence and credentials.

Ten Tales of Betrayal: The Threat to Corporate Infrastructure by Information Technology Insiders Analysis and Observations.

Shaw, E. D., & Fischer, L. F. (2005). Ten Tales of Betrayal: The Threat to Corporate Infrastructure by Information Technology Insiders Analysis and Observations. Monterey, CA.: Defense Personnel Security Research Center.

Eric Shaw and Lynn Fisher provide a review of ten cases of insider trust, examples of individuals for a number of mechanisms chose to lash out at their employer through an electronic weapon, and attempt to damage their employer. While these ten cases are varied in specifics, several core attributes and findings emerge.

The ten case studies selected come from non-DoD employers, in an attempt to apply this research to more than just military cases. However, the authors point out that when subcontracted personnel are hired to administer unclassified but critical government systems, not much is known about their background and their ability to hold a position of trust. As a result, these individuals may be more prone to insider attacks, as we will discuss. Mechanisms to prevent these attacks are discussed in this report, and are one of the main topics of this section. Insider threat prevention refers to both the policies and practices affecting employment screening, and to deter employee actions upon hiring.

Though this report focuses on human factors, it also provides consideration for technical security controls. However, the authors are quick to point out that 9 out of the 10 insiders studied used some mechanism to circumvent operational security, including computer security controls. The conclusion is that the sophistication of these attacks indicates the malicious insiders would have the skills, knowledge, and privileges necessary to circumvent most technical security controls. (Shaw & Fischer, 2005, p. 14) In fact, the authors further point out that in several of the insider attacks, their online activity was the first sign of any discontent, and at that point it is already too late. Any automated monitoring tool will most likely trigger once the malicious activity has been performed, and will most likely have a high rate of false positives. (Shaw & Fischer, 2005, p. 28) However, research has been performed in this and Shaw and Stroz (2004) created a software program to capture a number of these psychological factors. These factors include psychological profiling algorithms, keywords, communication-characteristic matching, changes in psychological state, and alerting the appropriate individuals.

While there are some common themes in the attacks, there is not one reliable profile on which to base an identification of potential malicious insiders. This is supported by other authors such as Gudaitis (1998) that a single cyber-offender profile is difficult to formulate, and does not take on the same characteristics of other criminal profiles. (Shaw & Fischer, 2005, p. 3)

Though a reliable profile is difficult to identify, the authors put forward a concept of the “critical pathway”, a mechanism to identify the likelihood of an insider attack through analysis of at-risk characteristics. The critical pathway is meant to capture the insider’s characteristics, stressors, and interactions to determine a profile and establish a mechanism to identify increased risk. The critical pathway is very similar to system dynamics, though on a less complex scale. The critical pathway is shown in Figure 2:

This is build from previous work by Shaw (1998a, 1998b) that identifies the critical pathway and several characteristics that may contribute to the increased risk of insider threat. These include:

1. A history of negative social and personal experiences.
2. Lack of social skills and a propensity for social isolation. The lack of social skills increases the odds of malicious activities when communication breaks down and the insider is unable to communicate their frustrations.
3. A sense of entitlement
4. Ethical Flexibility

(Shaw & Fischer, 2005, p. 31)

The report concludes with a series of recommendations, but focuses on two that can primarily reduce the number of successful malicious insider attacks. Managers should review and enforce policies regarding termination procedures and remote access policies. These and other factors were addressed by the authors. The authors discovered significant delays in corrective management actions to address personnel issues. In some cases, such as The Thief, the supervisor was aware of general disgruntlement but not the source, mostly due to a lack of communication. As the supervisor intervened with The Thief, the discipline only further aggravated him, though he did not communicate the specific cause to his supervisor. In fact, the authors state “One of the most important findings of this research was that there was a window of opportunity for dealing with the personnel problems affecting these subjects.” (Shaw & Fischer, 2005, p. 41) Table 6 provides an overview of disgruntlement for the 10 cases, and demonstrates the specific window of opportunity:

(Shaw & Fischer, 2005, p. 13)

The authors also discuss termination, and how termination can influence insider’s decisions when choosing their action. In some cases users are still permitted remote access in to corporate resources after termination, in other cases they have been allowed to continue to use company services as a customer, thus enabling their continued insider activity. Other cases show that psychological issues with terminated employees may prompt malicious insider activity. If the organization was aware of ongoing psychological problems, appropriate steps could have been taken to possibly prevent the insider attack. Termination practices played a critical factor in 8 of the 10 cases reviewed. Figure 1 shows the length of time between termination and incident, showing there is no clear pattern of time period. (Shaw & Fischer, 2005, p. 18)

The authors also demonstrate that attackers tend to make use of systems they are familiar with. They may use familiar systems both as the target of attack, or as an intermediary hop to their true target. This was also supported by Wood (2002), and is a critical component to the information hording and open information exchange in this KAM. As individuals are more likely to use or abuse the systems they most closely associate, those are the systems they may be more likely to harm. Consider that when allowing interconnections across organizations, that targeted applications may not be the critical ones the application owner has in mind.

DuPont Insider Threat - Can it be prevented?

Any of you who saw the movie Breach that came out last weekend know (http://www.breachmovie.net/), Insider Threats are a real concern, and have been ever since we had trusted information. This is information other people want. Intelligence has long been a common target for espionage, ever since men had greed and went to war. Now a form of greed is growing, and has been for a thousand years, greed for intellectual property. Really, greed for money, but as knowledge has become power and wealth, the value of IP has really come in to its own.

The case broke last week. Gary Min worked at DuPont for 10 years, but between August 2005 and December 2005 he accessed 16,700 PDF files from DuPont’s Electronic Data Library. His home in Ohio was raided on February 14, 2006, but the case details were unsealed just last week. (http://computerworld.com/action/article.do?command=viewArticleBasic&articleId=9011367)

(http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1244018,00.html)

However, what few seem to be discussing is how to STOP insider threats. Carnegie Mellon University’s CERT has been looking at this problem for years (http://www.cert.org/insider_threat/) and last week I had the opportunity to sit down with one of their lead researchers, Dawn Cappelli, and discuss some of her work. (http://www.cert.org/podcast/bios.html#cappelli)

Ms. Cappelli has written several papers discussing insider threat and how to prevent it, one of the most applicable and fascinating is her Common Sense Guide to Prevention and Detection of Insider Threats. (http://www.cert.org/archive/pdf/CommonSenseInsiderThreatsV2.1-1-070118.pdf)

I captured this article as a source paper for my PhD Thesis, and thought the rest of you may enjoy some of my notes:

This paper is a set of thirteen recommendations to organizations to reduce the likelihood of a successful insider attack. These recommendations come from a study of the insider threat database, and include both technical and non-technical recommendations. It is because of this insider threat that some organizations will not engage in information sharing.

The article has thirteen points that provide best practices for managers to protect their assets from malicious insiders. These thirteen recommendations can create the foundation of this paper discussing recommendations to prevent or safeguard against insider threats.

PRACTICE 1: INSTITUTE PERIODIC ENTERPRISE-WIDE RISK ASSESSMENTS

This is the issue of enterprise trust, why some groups will not play with others in an enterprise environment. Performing an enterprise wide risk assessment allows management to capture a point-in-time and accurate picture of their organization’s assets, and the controls in place to safeguard those assets.

The authors point out that most organizations focus on external threats during a risk assessment, rather than malicious insiders. These may include business partners, partner organizations, employees, former employees, contractors, satellite offices, even customers allowed to process information at their site.

The other advantage to an enterprise risk assessment is that most organizations leave the responsibility to check and protect against malicious insiders with the insiders themselves, often those who may be most likely to perform the attack. When organizations do not acknowledge the potential risk of insider threats, or threats and vulnerabilities in general, the organization may compromise its ability to achieve its mission.

PRACTICE 2: INSTITUTE PERIODIC SECURITY AWARENESS TRAINING FOR ALL EMPLOYEES

Information security awareness is critical to identifying malicious insiders – as many of their activities may go undetected by security controls.

The authors recognize there is no “profile” for an insider, they may be of any level in the organization and any education. From CEO to the janitor malicious insiders take many forms, though all malicious insiders share common traits – they have a personality disposition that identifies their tendencies. Therefore all employees, especially managers, must have general awareness training to recognize common traits of malicious insiders. This training should cover how to recognize malicious insiders through behavior, not stereotypes. The training programs should create a culture of security and awareness, and make sense for the culture of the organization.

The training should be based on documented, reviewed, and approved policy that has been vetted through an organizational process. (See recommendation 13) Ad-hoc policy without foundation in well-thought principles will lose credibility and become unenforceable. A critical component to documented policy is a confidential system to report potential insiders, observed by other employees.

PRACTICE 3: ENFORCE SEPARATION OF DUTIES AND LEAST PRIVILEGE

Separation of duties and the two-person rule is a foundational component of ensuring checks and balances exist in any system where power or authority is exhibited over users. These principles also require support of the least privilege principle, whereby users are not granted access beyond what is necessary for them to perform their job.

When a system of checks and balances is not in place, especially between management and system administration, the situation is primed for a malicious insider. One convicted malicious insider was quoted as saying it was like “the fox guarding the henhouse”, (p22) whereby no management component was reviewing and auditing his activity.

PRACTICE 4: IMPLEMENT STRICT PASSWORD AND ACCOUNT MANAGEMENT POLICIES AND PRACTICES

Passwords are the first line of defense in most organizational information systems. It is for this need that dual-factor authentication has increased in popularity, especially for sensitive systems. However, more than just a stronger authentication mechanism is necessary to prevent malicious insiders. Password policies are necessary, and only useful when enforced. This is more than just password complexity, it also includes sharing passwords, disabling when an employee is terminated, and removing unknown, unused, or unrecognized passwords. After all, if an account that has not been used in six months is disabled, chances are the account user will not miss it, and probably doesn’t even know it exists.

Also consider that password cracking and strength testing may actually enable and help insiders, as they may be the individuals asked to perform this password audit. A password audit gives the insider a legitimate reason to audit for passwords. Instead, enforcing password complexity, lifetime, and history, combined with strong user education, will work to prevent weak passwords.

PRACTICE 5: LOG, MONITOR, AND AUDIT EMPLOYEE ONLINE ACTIONS

The purpose of logging and monitoring is to associate online actions with the employees who perform them. This assumes users are only using their assigned accounts, under practice #4. Auditing can compare online and offline records to check for changes.

Auditing should occur on both a periodic and random basis. The IRS has a great model to monitor and audit actions, their method is able to process large survey sizes with sampling patterns. This system works on flags. In addition, random audits may keep malicious insiders off-guard enough to dissuade them from attempting malicious actions.

One example of an insider used to change the financial records before each quarterly audits. This hid the insiders evidence of fraud, and it wasn’t discovered until much later during a bank audit. By this time over $500,000 was lost. Random audits would have increased the likelihood of discovering this insider earlier.

PRACTICE 6: USE EXTRA CAUTION WITH SYSTEM ADMINISTRATORS AND PRIVILEGED USERS

Users with the highest level of technical ability and information access are particularly privileged to be in an opportunity to commit malicious actions. As a result their accounts must have extra monitoring and audit controls in place. Organizations should ensure user’s actions can be traced back, especially for those with privileged access.

One example had an administrator as a malicious insider. Suspicious management began logging the administrators actions to a separate, hidden log file. When the administrator committed malicious acts and deleted their regular log file, they did not know about the hidden log file. As a result the company was able to prosecute the administrator based on the hidden log file.

It is also helpful to let administrators and privileged users know when they are being logged, as it may dissuade them from malicious acts. While this may not stop all, such as the example above, it may help to reduce the number of potential malicious insiders. One way to make administrators know they are being watched and held accountable for their actions is to use dual-controls, where two administrators with rights are required for certain privileged functions.

PRACTICE 7: ACTIVELY DEFEND AGAINST MALICIOUS CODE

Malicious code is still problematic in most organizations, though a strong anti-virus policy can capture most malicious programs. However, custom logic bombs, scripts, and underworld Trojan tools may not have an antivirus signature, and will be missed during AV scans. To safeguard against these attacks, a more systematic approach is needed. Organizations should establish and enforce baseline configurations for software and operating systems. This baseline “snapshot” can also be used to identify systems that are out of configuration. This is similar to the file integrity checker provide by Tripwire, which may create many false positives, but when used properly on high-risk systems, may capture small changes such as custom code or new software.

PRACTICE 8: USE LAYERED DEFENSE AGAINST REMOTE ATTACKS

Using a layered defense helps to prevent malicious insiders to access the network remotely, either from home where they are more bold, or after termination where they may be vengeful. Strong defensive tactics include securing your VPN configuration, reviewing and strengthening the security architecture, and properly disabling access after termination. Organizations should consider changing the passwords before the user is terminated, to ensure a clean cut-off.

PRACTICE 9: MONITOR AND RESPOND TO SUSPICIOUS OR DISRUPTIVE BEHAVIOR

A high number of malicious insiders had previous arrests and criminal convictions, showing disruptive behavior is prominent before they were hired. Managers and HR departments should be on the lookout for characteristic traits of malicious insiders. Though aggressive or confrontational employees have been a problem in the workplace before, this is a new threat the HR department must be taught. The employees should also be educated and encouraged to speak out when they notice suspicious activity, especially that which may indicate a malicious insider.

Previously when the disruptive employees were not discovered, they were able to migrate within the organization, changing from one job to another to avoid detection. These employees also often would boast of their technical prowess or insecurity of the organization, stating how easy it would be to “wipe out all their computer systems’.

PRACTICE 10: DEACTIVATE COMPUTER ACCESS FOLLOWING TERMINATION

It is a common industry practice to disable computer access following terminating an employee, however a shocking number of organizations do not have strong policies and procedures to disable these accounts, especially if the organization does not use a single sign-on solution. When formal policies to terminate access are not in place, the account disabling process tends to be ad-hoc, and holes to allow access may be left open.

Popularly overlooked accounts may also include shared accounts such as system administrator accounts or DBA accounts, which may be disruptive to other users to change their shared password. However, this is a demonstration of the need to have as few shared passwords as possible in the organization, and to instead focus only role based access and group privileges.

PRACTICE 11: COLLECT AND SAVE DATA FOR USE IN INVESTIGATIONS

When an organization has a possibility of criminal activity, it should take the preliminary investigative steps to secure any evidence, and isolate the situation as quickly as possible. The key questions are who, what, when and where – because we most likely already know why an insider chose to act – greed, fame, revenge.

There is a thorough list of data to capture from the moment an incident is discovered. System logs, data access, application usage, system commands, connection methods, and connection addresses are common. In addition, the host configuration should be captured, with memory state, processes running, even the data on the screen at the moment of discovery may hold clues.

PRACTICE 12: IMPLEMENT SECURE BACKUP AND RECOVERY PROCESSES

Backup and recovery policy and procedure is common, but unfortunately often not followed diligently. Ensure that multiple backup copies exist, and are stored in a secure location, with redundant copies stored at a secure offsite facility. Saboteurs may destroy both the system and the backup copies to ensure their destructive task has full impact. By maintaining separate backup copies, and additional copies of critical Intellectual Property, such as source code, organizations can limit the impact from an insider attack.

PRACTICE 13: CLEARLY DOCUMENT INSIDER THREAT CONTROLS

When organizations make it clear that it will be difficult to perform an insider attack, that employees are being watched and monitored on a random basis, this may decrease the likelihood of an insider to even think about malicious activity. This is communicated in the Rules of Behavior (ROB), which captures explicit roles and responsibilities when an individual joins the organization, and documents what controls are in place.

This should also be the basis of continuous annual training, to remind employees of their commitment, the policy, and the consequences of being caught. The mere fact that an individual may be watched is enough to deter some malicious insiders.

Power Politics of the CIO

I’ve been meaning to start this blog for some time, I have quite a bit I want to say and get out about the role of Information Security Management. Then I came across this presentation today, and decided it was finally time to start.

Strassmann makes some excellent points in this transcript from 2003 (http://www.strassmann.com/pubs/fed/AFCEA-2003.html). He identifies three types of CIO – Asset based, Information Based, and Strategy based. His points are well taken about Asset based – that’s like a stockboy or warehouse clerk, just making sure everyone has computers. Boring. Information based is the next evolution, realizing that organizations require information to operate, as it is their lifeblood. But in the conclusion is where he hits it home, and brings the CIO’s role as a strategist into play – if information is the lifeblood of the 21^st century company, the CIO’s strategy plans the veins, heart, and makes certain we have no clogged arteries. We don’t want our organization to have a stroke.

Strassmann says “Information security thus becomes the mainstay of the legitimacy of a Strategic CIO because information assets can be easily corrupted, stolen or become obsolete.” Bad blood. We don’t want bad blood in our organization, or it will corrupt the entire… organism.

A boon for the CIO, and support for the role of information security management. I see this article as supporting the need for CSO/CISO as well, since the CIO will need to support these means. Will the CSO ever be on par with the CIO? Probably not. The CSO will probably always report up the chain, and may sit on the executive council, but mostly will be represented through another channel. Disappointing, but Strassmann makes a legitimate argument about the CIO and the struggles they deal with. CSO has an even tougher hill to climb.