Move Accountability

Of course, it’s one thing to transfer responsibility for information security outside IT, but if accountability doesn’t move with it, the CIO will be in big trouble. That’s why some CIOs do not even want to consider letting go of information security. "Even if IT security was moved out of IT, if something happened, I would still be on the hook," says Tom Smith, former CIO of Waste Management, who retired in March. "I think IT security is part of a CIO’s role and responsibility as opposed to a conflict of interest. I feel personally responsible for internal IT security, whether it be physical security or data security. To delegate that to a third party such as another security group outside of IT, I just think it’s the wrong thing to do."

But proponents of jettisoning security out of IT disagree. "I hear that concern 100 percent," says Capital IQ’s Murphy. "But when there is a breach, the CSO and I go to the CEO’s office together. It’s a teamwork issue. It’s not ultimately who’s on the hook for something-it’s a question of having people full-time worried about security versus IT. It’s the future of the company, and as executives you should both be accountable." Murphy says he’d rather have Capital IQ’s CSO, Ken Pfeil, go with him to see the CEO than go by himself.

When a CIO keeps information security inside IT, even if he creates a CSO-type role, he is much less likely to seek someone from outside the department or the company to cast a fresh eye on the ways the company handles security, says Spernow. The CIO is more likely to give it to a trusted lieutenant who shares the same views on security that he does. "How many bosses are going to be receptive to the information security person saying here’s how you’re screwing up? They can’t. It’s just human nature," says Spernow. "Typically CSOs are best when they come from the outside because they have to be a change agent, and if you’re bringing the baggage of people you owe favors to, it’s tough."

Think Like a Criminal

When corporate security began to be a distinct function in most companies during the ’50s and ’60s, companies usually wanted someone experienced at looking for and handling bad guys-former cops, mostly. IT security rarely requires wrestling anyone to the ground, but the mind of a malicious hacker isn’t that much different from that of a more physically oriented bad guy, argue security experts. So why do companies automatically assume that IT people can think like criminals? "Every information security policy I’ve ever seen is a joke because they are written by people who can be trusted," says Spernow, who has worked in corporate security for Fidelity Investments. "We have these exercises we do with IT people to try to show them that their intuitive response is to trust people. I wouldn’t hire anyone for a security position unless they were really paranoid."