In today’s business world, the CIO is faced with three interrelated issues – security, “plumbing support,” and revenue generation.  Of the three, security is often the most challenging.  Get that wrong and the consequences can ripple through the organization.

The CIO now needs to pay more attention to spending on IT Security because with the high levels of fear, uncertainty and doubt in the media regarding security breaches, there is a tendency to overspend in this area. IT Departments are already digging out of the misperception that IT spending in general is a black hole expense. That thinking has changed – CIOs increasingly are being relied upon to drive the company’s innovation and, consequently, its revenue.

With regard to plumbing support, keeping the lights on has always been part of the CIO's responsibilities, but it doesn't stop there. Now the CIO is involved in adding value to the organization. Specifically, the CIO is now in charge of developing software that automates redundant processes, analyzing data trends to help make business decisions, and partnering with other departments to implement new technologies that lead directly to competitive advantage and greater sales.

Against this backdrop, an organization's security posture has never been more important, yet many CIOs find it difficult to convey this in ways that are easy for the board and other executives to assimilate. Success in this endeavor is critical – how the CIO makes the business case often determines how much of the budget can be earmarked for security and whether funds will be directed in ways that demonstrably improve the company's security posture.

While more money is being earmarked for security, there is a lack of trust from the top because money spent on security is not money that will earn revenue for the business. It is defense, not offense. The CIO must prove to be a good steward of funding, and this includes not overspending. This trust is what drives the necessary funding to IT Security.

Managing Security with Visualization Tools 

CIO driven innovation can accelerate when security is proven to be well managed. A CEO does not have to wonder if the CFO is doing his job, he can simply look at the “books”. There is a common framework of debits and credits that business professionals understand. IT Security, however, is a relatively new discipline and most business leaders do not have a language for understanding it yet.

A visualization tool can simplify the CIO’s job by highlighting security gaps and providing a clear view to prioritize actions, plans, and investments. An effective tool will provide a framework that distills large sets of data, which empowers the CIO to easily understand and convey the security posture to the rest of the enterprise without losing people in technical minutia. A visualization tool abstracts complexity into a story that business people can understand.

A good tool will also perform a baseline analysis of all security metrics relevant to the organization and assign a rating to each one. In very simple language, this format allows everyone to instantly grasp the current situation as well as the roadmap to achieve improvement so appropriate funds can be agreed upon and targeted more effectively. A good defense is a good offense: the more efficient and effective the process of proving IT Security results, the more money can be allocated to offensive innovation pursuits.

Security metrics should be categorized from most critical to least critical. The essentials, like firewall outbound port blocking and weekly PC patching would fall into the most critical category, while change management processes and workstation backups would fall into a less critical category.

Each metric is then assigned a rating of 1 to 10 to describe how the current state impacts the overall security of the business. A rating of 1, for example, would reveal that a significant gap exists between the current and desired state, while a rating of 6-8 would represent a target state that most businesses should aim for. If a business is subject to enhanced government security mandates or a compliance requirement outside of the norm, then the target would be a rating of 10 which indicates a zero gap.

Creating a Roadmap

The most critical step with IT Security investment is to prioritize spending over a period of time. This is critical because most CIOs simply ask for a chunk of money but really don’t have an action plan for how they intend to use it.  A timeline of intended investment reflects at a very deep level that the CIO has the situation in order.

An effective visualization tool will provide direction on next steps. This roadmap is not intended to identify and implement improvement tasks in sequential fashion. Most often first efforts to mitigate gaps will have a bleed effect – they will not only raise baseline risk scores, but also the scores of risk metrics in other categories. So typically several tasks may have to be undertaken in parallel to achieve the best results.

For example, overhauling the firewall configuration, implementing firewall unified threat management (UTM), addressing password issues, and executing a data governance program – collectively spanning multiple risk categories – might have to be pursued along with advanced persistent threat (APT) protection, data-at-rest scanning, and external web system security measures, which also span multiple risk categories.

In essence, a visualization tool provides the CIO with the equivalent of the CFO’s “balance sheet.” The tool’s output starts with baseline measurements and over time tracks security improvements against an ever-changing threat landscape. This gets all internal and external constituents working from the same playbook and trusting each other so that real progress can be made with a minimal level of fear, uncertainty, and doubt.

Bottom Line Results

With the IT security story clearly conveyed within the context of the business strategy, the CIO helps the Board steer a path toward the right security solutions and investments. This process builds a strong foundation that not only protects the business but lays the groundwork for future innovation. Shedding its reputation as a spending black hole, the IT department takes its rightful place as an indispensable partner in growing the business.

Bill Murphy is President and CEO of RedZone Technologies, which he founded in 2001. The Annapolis, Maryland firm provides enterprise security solutions from core to edge, specializing in enterprise IT security, data governance, and managed services. Bill is the impetus behind the visualization tool CIO Scoreboard, which helps CIOs communicate transparently to the CEO and Board, simplify IT security issues, and obtain support for IT initiatives. Bill can be reached at 410-897-9494 or billm@redzonetech.net.