Security officers want business visibility, but will CIOs let them have it?

Any CEO who reads the newspaper knows that information security is anything but secure. Last week, the headlines were especially ominous, with the Code Red and Sircam worms threatening to gobble up the Internet, and reports that AT&T Wireless and Verizon Wireless were investigating a security breach that may have exposed the Social Security numbers of hundreds of customers. You'd better believe that CEOs are asking tough questions about security. But who should answer them-the CIO, or an executive focused on security?

For the past decade, CIOs (and CIO magazine) have been talking about alignment: about reporting directly to the CEO, about playing a business role, about speaking the same language as other executives. Bend your ear to the information security community, and you'll hear the same kind of rumblings....

"Security is a very broad discipline; you have to be all over the map," says Micki Krause, vice president of the board of directors for the International Information Systems Security Certification Consortium, or (ISC)2, a nonprofit organization that trains and certifies security professionals.

"You need to look beyond technical proficiency," she continues, describing the skills she needs as director of security at PacifiCare Health Systems in Santa Ana, Calif. "A lot of information security is marketing and sales. For a successful implementation of a security program, [the security officer needs] to solicit buy-in from all employees up to senior management, and that takes business acumen and an ability to translate technical requirements into business enablers. ? As technology evolves, security becomes increasingly more visible and critical, thereby organizations at a senior management level will increasingly understand the importance of the security function."

Sound familiar? Just replace the word "security" with "IT."

Krause reports to PacifiCare's CIO. But in a growing number of cases, security is being given a more prominent spot in the organization. Korn/Ferry's Jim Bock, a recruiter who specializes in IT and information security placements, has noticed that more chief security officers are starting to report directly to the CEO, on a peer level to the CIO. "It depends on the level of importance a company places on security," Bock explains.

Click here to continue reading this article over at CIO.COM.