A Unified Approach
- By Bob Pappagianopoulos
- Apr 07, 2008
In spite of the growing convergence of network security and physical security, it’s clear that many organizations have no plans to combine their IT and corporate security functions under a single CSO. That doesn’t mean those of us in non-converged businesses shouldn’t -- or aren’t expected to -- provide unified oversight of risks.
CEOs and their boards of directors have realized, in the wake of front-page scandals like Enron and high-profile losses of customer information, that enterprise risk is bigger than just physical or corporate security. They are encouraging security to work with other business units such as human resources, legal, compliance and information technology (IT) to ensure the whole risk picture is addressed in a unified way.
The relationship between physical and IT security is a growing part of this unified approach. We need to partner effectively with our physical security or information security counterparts to provide comprehensive security that’s in line with the goals of the business.
Numerous sources will tell you that the best way to accomplish this is to communicate. That’s true, but getting on the phone to say hello now and again isn’t enough. Neither is arranging an urgent meeting in the moments after a crisis. You should actively collaborate before an incident occurs to learn about one another’s departments, their responsibilities and structures and to develop plans for responding to various types of incidents that cross physical and information security boundaries.
Who Does What
Ask about the structure of your counterpart’s department. Map it out to give yourself a good understanding of who does what. Find out about all the duties performed; some of these may have close cousins in your own department, which may provide you unexpected opportunities to work together.
Then identify risks that apply to both functions and discuss collaborative options for mitigating those risks. To mitigate the risks associated with lost or stolen laptops, Actively develop plans for responding to various types of incidents that cross physical and information security boundaries for instance, physical security may provide laptop locks and cables and an acceptable use policy, while IT may install automated encryption, tracking or remote erasure software.
Determine the strongest combination of countermeasures appropriate to the risk. Create a list of potential incidents that would require a response from both of your departments. Then develop a response plan and process map for each incident type. Document which department will initiate the response, who will be responsible for each phase of response and at what point the other department should be contacted or brought in.
Cement With Documentation
If you have a very strong working relationship with your counterpart, you may already have an unspoken understanding of who will do what and when. But putting it in writing will help you in several ways.
If your counterpart should leave the company, it will make it easier for you to introduce the plan to his or her successor. It may also serve as an icebreaker to help you initiate a good relationship with your new partner.
It can be disseminated among the employees in a standard, consistent format. This way you’ll know that everyone in both departments has been apprised of his or her role in an incident, and you can fall back on the documentation if an employee drops the ball and claims ignorance as the excuse.
It can serve as a resource during postincident analysis, which may help you identify where things went wrong in the event of a problem or a breakdown in communication.
You can use it to show your executive management that you are a forward-thinking leader who is reaching out to other departments to help meet the needs of the business. This will help them to see security as an asset to the overall organization.
You may be able to use it as a data source for metrics that further increase the value of security in the eyes of upper management.
Communication with your counterpart in physical or information security is key to effectively protecting the enterprise as a whole. But don’t just stop at hello. Make your counterpart a true partner by working together actively to plan your protection strategies before you’re put to the test.
About the Author
Bob Pappagianopoulos is corporate director of technical services and operations and
CISO of Partners Healthcare System in Boston and a member of the Security Executive
Council, an international professional organization for leading senior security executives. For information, visit www.securityexecutivecouncil.com.