Seizing management power, is not keeping it

This past weekend I received my hard copy of the 20th anniversary issue of SC Magazine.  Hate it or love it, 20 years covering information security is a statement.  Congrats to Ilena and the rest of the team there! One article by Dan Kaplan caught my eye (BTW, I had no idea that Dan checks my blog for ideas, as Joe Franscella says). “Seizing Management Power” chronicles the evolution of the CISO position “from introverted techie into slick businessperson”. Dan looks at Howard Schmidt’s career from police officer and Ham radio enthusiast to security pro today. He also looks at several other prominent people who have held the CISO position at large corporations.  Interesting in that each of these people came in and set up security programs and then moved on.

Today’s CISO’s are as likely to have an MBA as they are a CISSP says Kaplan.  I agree with Dan, they are as likely. But just as the mission has evolved from techie to business speak, the scope has also been narrowly defined. It is an architectural position, not a long term place at the table. As the article points out, the CISO needs to be proficient in “people, processes and technology”.

Ultimately though Kaplan states that “going forward, though, as the CISO position assures its foothold in the corporate boardroom, some observers wonder if the function has an infinite lifespan”. My theory is not an infinite lifespan in terms of function. There will always be the need to come in and set up or reshape a security program.  But once that is done, what is next? How long does the CFO and CEO want to keep paying big bucks for the architect? The CISO comes in with a mandate and and power, but can they keep it? That is the hole in the bottom of the CISO bucket.

I think the CISO’s architect role can be accomplished with a proven methodology, in a given time frame and within an agreed upon a budget and then handed off to a caretaker and not the architect. CISO’s are too highly compensated to be expensive cheerleaders. At the end of the day that is why I think CISO is a great place for a consultant.