 security by design part 13 security by design part 13 hemraj tue 10212025 549 security by design part 13 joseph f norton sort by latest trending joseph fnorton latest trending image my blog posts here mostly focus on the complexity of systems supporting business operations the complicating factors of our reliance on the internet for business communications and commerce the extended risk and value chain of multiple layers of suppliers and customers engaged with our businesses and the roles and methods of managing information security management in large and small interconnected businesses today i am going to focus narrowly on the role of the chief information security officer ciso  i have been engaged in information technology for enough years to have witnessed the birth of the role of the chief information security officer in the early days of my career we did not have such a role in an it organization we had roles for security managers reporting to the chief information officer cio or chief technology officer cto and even lower in the hierarchy of information technology organizational structures indeed i was once designated security manager for a large aerospace company back in the longago times of the 1980 s in another stage of my career i served as an svp level chief security officer for a large multinational outsourcing firm with multiple cisos and security officers sos reporting to me the reason i am turning to the ciso role today is that i recently read an article which declared that   to put it bluntly the ciso role is dead  quite a striking comment especially if you hold a ciso title in an organization today normally when i include someone else s words in one of my posts i include an attribution to that person as the source or author in this case the article was attributed to an online forum for a for profit company not an individual author and i have chosen not to provide pro bono advertising when i read this comment it really caught my attention  the ciso role is dead  is a strong statement which resonates with what i am seeing and experiencing today in many organizations maybe the ciso role has outlived its purpose or is now facing a need to evolve the threats and risks our businesses face today are at the highest level of systemic digital risk i have experienced in my 45 years in the information technology industry   information technology organizations no longer control all the information technology devices and systems in use in their organizations today maybe it is time for the ciso role to evolve or morph into something new a role which truly addresses the need for a holistic approach to managing systemic information risk inherent in our complex digital systems if so what should this new role look like is it time to break out of the information technology organizational driven focus of information security and elevate a company s focus on and treatment of information security risk should this role be a part of an information technology function or should it be part of a broader approach to managing business risk and reside elsewhere in a business organization  it risk business risk if we accept that all it risk is business risk then we should logically accept that managing information risk should not reside solely within an information technology organization thus i propose that two changes are needed to adequately address the inherent systemic risk in our complex digital systems the first is a new role the second is that the new role should not be placed inside the information technology organization digital risk and resilience officer this role digital risk and resilience officer drro should be part of a business s enterprise risk management erm function and may or may not exist as the only senior role addressing information risk and security i envision that many information technology organizations may elect to maintain a traditional chief information security officer ciso role solely focused internally within the it organization if so i suggest that the role should no longer be called a chief role but rather be titled as an information security officer role as many business organizations already embrace enterprise risk management and have a senior leadership role for a chief risk officer cro i envision that the emerging drro role would report to the chief risk officer and collaborate with both the cro and the it information security officer iso the digital risk and resilience officer role should represent a significant evolution in purpose responsibility and vision for dealing with the threats and systemic risks our businesses now face every day i would encourage you all to think about the potential of a digital risk and resilience officer role and focus as an evolution needed in information security which will be more encompassing and vital to the success of your business s future in my next bog post i will expand on my thoughts concerning a digital risk and resilience officer role  joseph f norton is a risk security and crisis management professional he is a founding member and qualified technology executive of the digital directors network special advisor for risk and cybersecurity to divihn chair of the advisory board with next era transformation group and chief security officer with apf technologies he has served as chief security officer svp at atos chief technology officer and head of operations svp at philips chief technology officer svp at novartis executiveinresidence with mckinsey company and chief technology officer at mcdonald s he has also held professional roles during his career with jpmorgan bank oracle sybase and grumman aerospace corporation and the united states navy latest webinars our proven track of record view all image webinar clone of the ciso exchange for a safer digital world image webinar the ciso exchange for a safer digital world image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government popular articles unleashing business potential the power of adaptive enterprise architecture in the digital age businesses must adopt an adaptive enterprise architecture to succeed doug picirillo 15 best practices in salesforce development many businesses have decided to use salesforce s customer relationship management solution kannan venkataraman 