APRIL - 2023ENTERPRISE SECURITY| | 19resulting in data or intellectual property theft or exposure of sensitive customer information. Yet, IS does not typically patch vulnerable systems, nor install and configure those systems. If IT is not properly performing those functions, the IS department is where executives will look for an explanation when there is a major data breach.Clearly, while it is practical, prudent, and sometimes required to separate responsibilities for Information Technology and Information Security, it is not so clear as to how to actually accomplish this. Roles and tasks can certainly be divided among the technical staff of both teams, but ultimate goals of high operational availability and information security cannot be achieved without a high degree of coordination between the two teams. In my experience, IT and IS tend to interface with each other in one of two ways - 1) Segmented Responsibility, or 2) Shared Responsibility. In the Segmented Responsibility model, responsibilities for various aspects of information security are clearly divided with the Information Security team reporting to a completely separate branch of executive management from IT. IS dictates security policies and standards that the IT team must follow. IS has direct control over many functions and services such as firewall updates, intrusion detection/prevention (IDS/IPS) systems, collection, analysis, and monitoring of system/application logs, vulnerability scanning, Identity and Access Management, cloud security administration, third party risk management, business resilience planning, and incident response. The relationship between IT and IS can sometimes be characterized as adversarial rather than cooperative. In the Shared Responsibility model, the IT team takes ownership of certain aspects of information security, such as network/cloud architecture, secure configuration management, vulnerability remediation, firewall management, Identity Management, and DevSecOps. IT and IS work together to assess risk, formulate policies and standards, select technology solutions, and respond to incidents. The CISO and IS team may still report to a separate executive branch, but their relationship is typically characterized as collaborative. There are certainly pros and cons of both models. In the segmented model, decision making is more efficient, requiring less interaction, communication, and coordination between the two groups. Each team is also freed to focus on their respective primary objectives for the business. On the negative side, the interactions between the teams can easily become adversarial, and when security incidents occur, the teams can quickly seek to assign blame on the other.The Shared Responsibility model promotes a team oriented approach to security, recognizing that the two groups have important roles to play in the overall security of the organization. Though the CISO still has ultimate responsibility for information security, the two teams work collaboratively to design and configure infrastructure, systems, and services to ensure maximum security as well as availability. The downside is the significant amount of coordination and communication required when assessing risk and making decisions. Blame for security incidents can still be cast between the groups as well.I've worked in variations of both models during my career in IT and IS, and my preference is the Shared Responsibility model. I do recognize however that it takes commitment and mutual understanding between the CIO and CISO to make this work. When it does work, it can be a strong partnership that is also a win-win for both parties. The CIO can still be freed to focus on operational goals, while recognizing that information security incidents are a significant threat to those goals. Likewise, the CISO is freed to focus on information security while realizing that many operational aspects of IT are essential for preventing incidents.Whichever model works best for your organization, CIO's and CISO's should realize that they cannot fully operate or achieve their objectives without the other. For me, I would rather be assured that the CIO has my back and vise-versa when it comes to keeping the organization safe and secure, or when maximizing availability and function for the business. ESTHE SHARED RESPONSIBILITY MODEL PROMOTES A TEAM ORIENTED APPROACH TO SECURITY, RECOGNIZING THAT THE TWO GROUPS (IT &IS) HAVE IMPORTANT ROLES TO PLAY IN THE OVERALL SECURITY OF THE ORGANIZATION
< Page 9 | Page 11 >