These forward-thinking IT managers are working at dismantling the stereotype of the risk-averse security professional-cum-business foe. How? By showing business colleagues they understand company operations and appreciate corporate goals.
"If security professionals' sole objective was to eliminate risk entirely, no one would have a BlackBerry, no one would have a laptop, and we'd all shred everything the second we read it," says Chad Mead, head of infrastructure security for Global Technology Infrastructure at JPMorgan Chase, headquartered in the US. "But today's business has changed and become much more mobile, so security has to become more of a partner with business."
The need for security pros to tune in to business is not unlike the situation IT experienced about a decade ago, when organizations started thinking about technology as a strategic asset. Then, IT directors learned that presenting technology plans to the board or operational units without emphasizing business benefits was an exercise in futility.
"Businesses have to understand and be willing to listen to security people, but it's up to security managers to coax the business folks along," Mead says. "It's up to security professionals to change perception of security as impediment, and help business managers think of incorporating security upfront."
Security professionals who have operations backgrounds might find changing their mind-sets and becoming a partner to business easier than most. But an operations background is not essential. More important is that security managers get out of their offices and ask questions.
Prime objective
Understanding the business "should be the key objective for any risk manager," says Andre Gold, head of security and risk management for ING Financial Services, and former CISO at Continental Airlines. At ING, as at Continental, Gold says he spent time learning how business operations such as call, distribution and maintenance centers work and measure success. "Once you understand the business, it gives you credibility. You can have conversations about security as a business enabler, not an inhibitor," he says.