Defining a Role

As cyber and physical security converge, the role of the chief security officer must evolve

The sudden long lines at gas stations in the United States, last May were for many, a surprising sight. Indeed, the situation emerged without warning: A ransomware attack disabled computer systems for a major regional provider, Colonial Pipeline, creating shortages and panic-buying. In North Carolina alone, 68 percent of gas stations were out of gas.

The scenes clearly illustrate an emerging conundrum for organizations: Cyber security and physical security are converging. As more systems become interconnected, business operations increasingly depend on digital infrastructure to manage everything from the supply chain and power grids to intellectual property.

Cascading Effects of Dynamic Risk
In 2021, organizations contended with several massive-scale threats, including.

  • One of the largest disruptions of supply chain availability the world has ever seen
  • A record year of security vulnerabilities, particularly to our critical infrastructure
  • The deadliest year for major weather disasters in four years
  • The worst assault on the U.S. Capitol since 1812
  • An all-time high in the number of people working from home

In fact, 99 percent of security and risk management professionals experienced a critical event in the past 18 months, according to a commissioned study conducted by Forrester Consulting. These incidents show no signs of abating. The wide scope of such critical events means no business function or industry can escape the impact.

It is also clear from this list that threats are no longer isolated events. In the modern world, risk is dynamic and complex. Risk A has a high potential to evolve into Risk B. That is, a hacker may steal intellectual property from your most important supplier and potentially impact your operations or revenue goals, as the following examples show.

Supply chain. Hackers breached the servers of Quanta Computer, stealing and leaking proprietary schematics of Apple products. Though the attack didn’t affect Apple’s business operations, the threat to a supplier underscores the fragile link between digital and physical assets.

Critical infrastructure. During a breach of a Florida water treatment facility last year, a hacker reset chemical levels to a potentially dangerous range. The event significantly concerned the Biden administration, which announced plans to bolster security for the sector.

People safety. A ransomware attack can delay or even prevent hospitals from providing critical patient care.

This conundrum – that cyber risk rolls into physical risk – is transforming the chief security officer’s role.
Faster than expected, they’ll need to almost think like a CEO and take a wider view of organizational risk and a more proactive role in responding to these new realities. To get there, here are three key changes you can make right now.

Cultivate a culture of organizational resilience. An initiative as important as this must start at the top, with a leadership vision that outlines what organizational resilience means to your business. Achieving a culture of organizational resilience will require both a shift in thinking as well as a new framework.

The convergence of cyber and physical security points to what should be an obvious fact: Leaders should recognize their functional areas are no longer unique, separate operations. They often overlap or intersect, impacting others. With disrupted events so tightly correlated, collaboration among teams isn’t simply a nice to have. It is table stakes.

The interconnectedness of systems means risk can no longer be handled by individual teams. If a physical threat emerges from a security breach, you’ll need help from human resources, finance, corporate communications, disaster recovery, enterprise risk management, IT, cyber security and physical management, etc. That is why it’s crucial to bring together the right people from across the organization and agree on common objectives and goals.

Eliminate operational silos. With the right people at the table, look at what’s keeping you from accomplishing your vision. What are the pain points – both operationally and externally – hindering you from mitigating risk?

Often, decision-making happens in silos and stands in the way of resilience.

The key to breaking down operational silos is a unified view of risks impacting the whole business. Once you can see the big picture, it is time to expand business continuity programs so you can manage risk more effectively. You’ll need to evaluate and document the risk appetite and tolerance levels of each functional group for product or service delivery disruptions to their internal and external stakeholders. Finally, ensure everyone is on the same page and reaching for the right goals with a set of combined metrics.

Embrace AI and automation. Organizations have more data and information than ever before. In fact, with 2.5 quintillion bytes of data now being created daily, 90% of the world’s data has been created in just the last two years. New information is being created, and at times replicated, every second.

It is no longer humanly possible to monitor and track developments even within your own systems, in a timely manner. AI-powered risk intelligence will help you monitor dynamic risk at scale. Automation can be used to identify and act on the cascading impact of a cyberattack, from activating response teams to alerting those who may be impacted.

It is not enough to know a storm is coming. For faster, better decisions, you also need to know which operations may be affected and which employees are in the path. A single platform combining big data, artificial intelligence and automation of key resilience processes is your best bet for a 360-view of any critical event impacting your business.

The key is you don’t have to sit and wait for the next crisis before you manage it. Much can be done in advance – from identifying the right teams to engage to uncovering the gaps and breaking down silos.
Without question, risk is now a board-level conversation. As cyber security and physical security continue to merge and physical threats become more dynamic, security leaders must understand how their people, places and technology must change to get ahead of these complexities in 2022 and beyond.

This article originally appeared in the April 2022 issue of Security Today.


  • Top 5 Cybersecurity Trends of 2023

    Top 5 Cybersecurity Trends for 2023

    Cybersecurity is a rapidly evolving field, and staying on top of the latest trends is essential for organizations looking to protect themselves from cyber threats. Read Now

  • See How Reddit Users Have Unlocked the Dark Side of ChatGPT

    See How Reddit Users Have Unlocked the Dark Side of ChatGPT

    In less than four months after its debut, ChatGPT continues to garner attention from users all around the world who have made use of the AI system that answers questions, creates computer code, and much more. Read Now

  • Enforcing Zero Trust in a Hybrid Work Environment

    Enforcing Zero Trust in a Hybrid Work Environment

    The effects of the pandemic have rippled across the business world like a meteor hitting a pond, creating a new plethora of challenges that incorporated into MBA curriculum for years to come. Read Now

  • First Responders Give NIST Their Communications Tech Wish Lists

    First Responders Give NIST Their Communications Tech Wish Lists

    Our first responders have spoken. An extensive research project conducted by experts at the National Institute of Standards and Technology (NIST) reveals what our country’s police, fire, emergency medical and 911 dispatch responders think about the communications technology they use on a regular basis and how they would like developers to improve it in the future. Read Now

Featured Cybersecurity

New Products

  • Tyco Kantech EntraPass security management software

    Tyco Kantech EntraPass security management software

    Johnson Controls, the global leader in smart, healthy and sustainable buildings, and architect of the Open Blue digital connected platforms, has released the newest version of the Tyco Kantech EntraPass security management software. 3

  • LiftMaster Garage Door Opener

    LiftMaster Garage Door Opener

    LiftMaster Transforms the Garage Door Opener Into a Sleek Smart Home Device That Does More Than Open and Close the Garage Door 3

  • Schlage RC reader controller

    Schlage RC Reader Controller

    This new innovative device combines the power of the Pure IP™ access control technology pioneered by ISONAS with Schlage’s intelligent hardware and credentials, delivering a comprehensive and cost-effective perimeter solution to customers. 3