I’ve been meaning to start this blog for some time, I have quite a bit I want to say and get out about the role of Information Security Management. Then I came across this presentation today, and decided it was finally time to start.
Strassmann makes some excellent points in this transcript from 2003 (http://www.strassmann.com/pubs/fed/AFCEA-2003.html). He identifies three types of CIO – Asset based, Information Based, and Strategy based. His points are well taken about Asset based – that’s like a stockboy or warehouse clerk, just making sure everyone has computers. Boring. Information based is the next evolution, realizing that organizations require information to operate, as it is their lifeblood. But in the conclusion is where he hits it home, and brings the CIO’s role as a strategist into play – if information is the lifeblood of the 21st century company, the CIO’s strategy plans the veins, heart, and makes certain we have no clogged arteries. We don’t want our organization to have a stroke.
Strassmann says “Information security thus becomes the mainstay of the legitimacy of a Strategic CIO because information assets can be easily corrupted, stolen or become obsolete.” Bad blood. We don’t want bad blood in our organization, or it will corrupt the entire… organism.
A boon for the CIO, and support for the role of information security management. I see this article as supporting the need for CSO/CISO as well, since the CIO will need to support these means. Will the CSO ever be on par with the CIO? Probably not. The CSO will probably always report up the chain, and may sit on the executive council, but mostly will be represented through another channel. Disappointing, but Strassmann makes a legitimate argument about the CIO and the struggles they deal with. CSO has an even tougher hill to climb.
