Information Security Strategy: CISO, CIO, and Digital Forensics

Introduction

The world of information technology (IT) has evolved tremendously in the last few decades. Today, IT systems permeate virtually every aspect of work in the organizational setting — from strategic planning functions to administrative and operational functions such as human resource management, payroll management, project management, procurement, customer relationship management, and financial management. These systems have enabled organizations to undertake a wide variety of tasks with far greater ease, effectiveness, and efficiency than ever witnessed. Nonetheless, with more dependence on IT systems, organizations increasingly face a significant problem: information security (Andress, 2011). Against the backdrop of growing incidents of hacking and other cybercrimes, protecting information has become a top priority for organizations — small and large — in diverse sectors and industries (Vacca, 2013). Indeed, information security has been identified as a key ingredient of organizational success in the 21st century. Recent incidents of cybercrime — such as the Equifax data breach (July 2017), the WannaCry ransomware attack (May 2017), the JPMorgan Chase Bank hacking incident (2014), the eBay data breach (2014), and the Sony PlayStation Network hacking incident (2011) — are stark reminders of the severe consequences information security failures can have on organizations.

It is imperative for an organization to have a robust information security strategy. Any prudent organization cannot afford to be casual when it comes to information security. This is particularly important because cybercriminals are employing increasingly cunning methods to gain unauthorized access to data (Whitman & Mattord, 2017). Organizations must therefore deploy equally ingenious information security techniques. An information security strategy acknowledges information security as a priority for the organization, clearly identifies roles and responsibilities, and outlines competence areas and resources relating to information security. This paper presents an information security strategy for the organization. Attention is specifically paid to the role of the Chief Information Security Officer (CISO), the role of the Chief Information Officer (CIO), and how the digital forensics function complements the overall security efforts of the organization. The paper also evaluates the operational duties of digital forensic personnel and highlights the technical resources available to digital forensics personnel for performing forensic audits and investigations.

With information security increasingly becoming a priority for the organization, having a CISO is imperative. The U.S. Department of Homeland Security's (DHS) Information Technology (IT) Security Essential Body of Knowledge (EBK) defines a CISO as an officer in charge of an organization's information and physical security strategy (DHS, 2008). The officer is specifically involved in developing and enforcing the organization's information security policies and procedures, information security awareness programs, disaster recovery and business continuity plans, as well as compliance with relevant government laws and regulations.

Role of the Chief Information Security Officer

The CISO position is essentially an executive position (Conklin & McLeod, 2009). The CISO serves as the head of all information security operations in the organization. One of the important functions performed by the CISO involves developing the organization's information security plan — a document that details all security vulnerabilities of the organization as well as procedures and techniques for addressing those vulnerabilities. The CISO may execute this function, for instance, when the organization is contemplating enhancing information security in the wake of a significant security breach. When such a breach occurs, it is the role of the CISO to recommend specific ways in which the organization can prevent a similar breach in the future.

Part of ensuring information is secure involves acquiring appropriate information security products. It is the duty of the CISO to recommend to the organization the most suitable security products and the most suitable vendor for providing them (Andress, 2011). This role is particularly crucial when the organization is, for instance, installing a new information security system. It is not sufficient merely to have an information security plan and to acquire the required products: all employees within the organization must also have comprehensive information security awareness (DHS, 2008). Ensuring this awareness falls under the umbrella of the CISO. The CISO is responsible for developing an information security awareness program for the organization and for designing and implementing training initiatives to equip employees with an understanding of the organization's information security plan and their roles in promoting information security.

Fulfilling these roles requires the CISO to possess a number of competencies. Areas in which the CISO should be competent include data security, system and application security, security risk management, digital forensics, incident management, business continuity, IT security training, physical and environmental security, regulatory compliance, and procurement (DHS, 2008). These competencies place the CISO in a better position to fulfill the information security needs of the organization.

It may appear as if the CISO and the CIO are one and the same or perform similar duties. While their duties generally revolve around information security, the CIO holds a more senior role. The CIO is a member of the organization's topmost executive team and serves as the most senior IT officer in the organization. Ordinarily, the CIO is accountable to the Chief Executive Officer (CEO). The overarching role of the CIO encompasses developing the organization's overall IT strategy (DHS, 2008). This relates not just to information security, but also to IT policies and information systems (Conklin & McLeod, 2009). For example, if the organization desires to automate its processes, it is the job of the CIO to develop a viable IT strategy and to oversee its implementation.

Role of the Chief Information Officer

The CIO is also involved in evaluating the organization's IT strategy (DHS, 2008). At its core, a strategy is meant to achieve certain goals and objectives. For instance, the organization may adopt an IT system with the aim of reducing administrative or operational costs. In this regard, the CIO monitors relevant metrics to ascertain whether the specified objectives were achieved. Based on this evaluation, the CIO can then make recommendations to management. Another important role of the CIO relates to the acquisition of IT infrastructure and personnel. The CIO is responsible for ensuring the organization has the necessary IT infrastructure to support its computing and data processing needs. As the leader of the IT team, the CIO must also ensure the organization has a pool of highly qualified IT personnel to fulfill its IT needs — which involves, for instance, participating in the recruitment, development, and management of IT staff. Finally, the CIO has a duty to monitor IT trends (DHS, 2008). The IT world is a rapidly evolving landscape, and the CIO must ensure the organization remains current with the latest developments in the field.

By developing and implementing a comprehensive and effective IT strategy, the CIO provides assurance that the organization has the resources, capabilities, and competencies in place to manage its IT functions. One of the ways the CIO builds the organization's information security capabilities is by developing a formal security awareness, training, and education program. Such a program can provide several security assurances. First, an information security training and awareness program can provide assurance that the organization will comply with all relevant laws and regulations, thereby preventing litigation. Whereas the CIO is generally responsible for ensuring compliance, they delegate specific roles to subordinates. With wide-ranging information security awareness, the CIO can be assured that subordinates will fulfill their roles in accordance with applicable laws and regulations. The CIO can also assure business continuity through such a program. Information security training covers diverse topics, including information security risks, techniques, and roles and responsibilities. In the event of an information security disaster, employees are more likely to ensure business continuity if they understand what information security entails.

As the officer in charge of all IT functions in the organization — including the security function — the CIO must certify the organization's security functions and data assets. The CIO can rely on a number of methods, processes, and techniques to fulfill this role on a day-to-day basis. Notable among these are enforcing controls for the operation of IT infrastructure, preventing unauthorized physical access to the organization's premises, enforcing access controls, and enforcing procedures for handling data (Stallings, n.d.).

Conclusion

In the future, human life will be more dependent on computing systems than ever before. Computing systems already dominate virtually every aspect of human life — from transportation and healthcare to business and public service delivery. As computing systems progressively become the center of human activity, stronger mechanisms for safeguarding data are paramount. Data is now arguably one of the most valuable assets an organization can possess, and protecting it is critical to the organization's success in an increasingly digital environment. Given the disastrous consequences of information security incidents, organizations with stronger information security systems will be better positioned to navigate the complex world of computing. Organizations must pay even greater attention to information security if they are to effectively realize the full potential of IT systems.