 security by design part 14 security by design part 14 hemraj tue 10212025 627 security by design part 14 joseph f norton sort by latest trending joseph fnorton latest trending image i began my last blog post by quoting from a business forum i had read   to put it bluntly the ciso role is dead  and i closed my last post saying that i would encourage you all to think about the potential of a digital risk and resilience officer role and focus as an evolution needed in information security which will be more encompassing and vital to the success of your business s future some of you who read my last post may have dismissed my comment as out of hand others may have read a bit deeper into my comments and your reaction at least internally were that joe has no clue what he is talking about just maybe one or two of you may have thought about my comments and said to yourself he may be onto something i do not claim to have all the clues but i can assure you that throughout my career i have prided myself in working hard to ensure i had at least half a clue concerning what was going on around me in my professional domain it is a fair bet for me to say again today that  the threats and risks our businesses face today are at the highest level of systemic digital risk i have experienced in my 45 years in the information technology industry   information technology organizations no longer control all the information technology devices and systems in use in their organizations today let me take this one step further   never in the history of modern business operations has there been a risk domain as impactful as information technology information technology and digital business systems are the only risk domain which can bring my company s business operations to a complete standstill in an instant  this is a quote from a discussion i recently had with the head of enterprise risk management for a multibillon dollar business my conversations during the past year with many chief risk officers enterprise risk managers and chief information security officers have all led me to form my opinion that it is time to start thinking about and acting on the notion that the ciso role as we know it today is past its shelf life and it is time to seriously embrace a digital risk and resilience officer role the ciso role as we know it today is past its shelf life it is time to embrace the digital risk and resilience officer role  the traditional ciso role is intended to address the protection of an organization s information technology digital business systems and data from attacks this is often focused on external threats and can also include controls to address internal misuse of information systems and data this is a narrow focus given the widespread use of digital systems data communications and workplace technologies in use throughout businesses their customer chains and supply chains while cybersecurity risk management focuses on cyber threats and recovery of information technology systems it is a focus which rarely addresses the impacts to the rest of a business organization enterprises risk management acknowledges cybersecurity threats and risks but sees these risks through a ciso s eye usually not through the eyes of your business i have found it rare when speaking with erm leaders and chief risk officers to find a fully integrative understanding of the true extent of digital disruption impacts and the need for a business integrative approach to ensure digital resilience when recovering from such business disruptions another impediment to embracing digital resilience a required new core competence is what i call grade position inflation in cybersecurity prior to 1995 i do not think there was any role in business for information technology entitled chief information security officer there were roles in the 1970 s and 1980 s for information technology security and the role of information technology security manager was common steve katz is credited as the first person appointed to a chief information technology officer role by citi bank in 1995 after citi bank suffered a series of successful cyber security attacks by russian hackers in the 1990 s and into the early 2000 s it was common to have an information technology security manager role reporting to a chief information officer or a chief technology officer this role was often filled by a manager or director level position as the frequency of cybersecurity attacks escalated through the 2000 s and business impacts became larger we begin to see the escalation of information technology security managers to higher grade levels there was something darwinian about the escalation of security managers to chief information security managers and further to director and officer roles today it is not uncommon to see ciso roles as vice presidents or senior vice presidents reporting to chief information officers and even to reporting lines directly to business chief executive officers raising the position and salary levels of cisos does not directly translate to significantly improved cybersecurity or digital resilience organization performance in my experience even for cybersecurity and digital resilience is primary driven by organizational culture strong governance professional competence and employing a right role right person approach a very simple equation my arriving at my realization for a digital risk and resilience officer role can be summarized as follows chief risk officer is a fulltime role head of erm is a fulltime role ciso iso role is a fulltime role ciso iso attention to digital risk and resilience is a parttime role digital risk and resilience calls for fulltime attention given the potential for catastrophic business disruption impacts thus digital risk and resilience should be a fulltime role while maintaining the traditional information security officer manger role the ciso iso role is not dead it is time to embrace a new and improved role focused on digital risk and resilience the digital risk and resilience officer role should represent a significant evolution in purpose responsibility and vision for dealing with the threats and systemic risks our businesses now face every day i again encourage you all to think about the potential of a digital risk and resilience officer role and focus as an evolution needed in information security which will be more encompassing and vital to the success of your business future in my next bog post i will expand on what this might mean to cro erm drro integrative business approach to enterprise digital risk and resiliency  joseph f norton is a risk security and crisis management professional he is a founding member and qualified technology executive of the digital directors network special advisor for risk and cybersecurity to divihn chair of the advisory board with next era transformation group and chief security officer with apf technologies he has served as chief security officer svp at atos chief technology officer and head of operations svp at philips chief technology officer svp at novartis executiveinresidence with mckinsey company and chief technology officer at mcdonald s he has also held professional roles during his career with jpmorgan bank oracle sybase and grumman aerospace corporation and the united states navy latest webinars our proven track of record view all image webinar clone of the ciso exchange for a safer digital world image webinar the ciso exchange for a safer digital world image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government popular articles unleashing business potential the power of adaptive enterprise architecture in the digital age businesses must adopt an adaptive enterprise architecture to succeed doug picirillo 15 best practices in salesforce development many businesses have decided to use salesforce s customer relationship management solution kannan venkataraman 