Security Chiefs Gain in Popularity Though Many Companies Skeptical

Digital Evolution

Or as the man ultimately hired for the job remarked, clients wanted "one neck to choke."

Erick Herring was hired in August 2001 as chief security officer, a title that hardly existed two years ago. It's an increasingly popular job title, particularly with CEOs showing more interest in security after the Sept. 11 attacks.

"Senior executives, say CEOs, would call in the head of (information technology) security and the head of physical security into his office and say, 'Are we prepared?"' said Giga Information Group analyst Steve Hunt. "And the two guys had never met."

High-profile chief security officer hires over the past year have occurred at companies such as AOL Time Warner and Sun Microsystems, while a "CSO Magazine" debuts this month.

Executive search firms are also paying attention. Christian and Timbers wasn't recruiting any CSOs a few years ago; now it does five or six a year.

But that doesn't mean all of corporate America is running out to hire a CSO. Many companies aren't so sure they need one _ or even what the bearer of the title is supposed to be doing.

Chief security officers mean different things to different companies. Some handle physical security, some secure company networks from hackers. Others, like Herring, focus mostly on making sure products are secure. Some do all three.

Companies are wrestling with tough questions:

Should one person handle physical and computer security? Should the CSO push security at any price or find the most efficient solution? Where does the job fit in the corporate hierarchy?

Christian Byrnes of the research firm META Group says only about 30 percent of companies have the equivalent of a chief security officer, with only about 5 percent of them combining physical and information security under a single person.

Larger companies are particularly cautious.

When Christian and Timbers surveyed 390 executives at Fortune 1000 companies in April, 95 percent said they needed to hire a CSO but only 25 percent were ready to hire and 8 percent had begun recruiting.

Hunt says even the Sept. 11 effect was minimal. While some companies created the "CSO" title, for many the job already existed under a different name so the CSO had little new power.

"The organizations were quick to get someone in place, but they may not have had the power they need to effect change," said Ray Wagner, research director at Gartner.

Often, CSOs don't work out.

"Lifespans of 12 to 24 months are not uncommon," says Gary Lynch, who held top information security jobs at Prudential and Chase Manhattan and is now a consultant at Booz Allen Hamilton. "They become overwhelmed with operational issues and never get to strategic issues."

Growth projections for the job vary by sector: Giga estimates that most software companies will have CSOs by 2009, up from 20 percent next year. But in retail, the number is projected to grow to only 10 percent, up from 3 percent.

Many companies are waiting to see how the first wave of CSOs fare.

Others have simply decided that an all-encompassing CSO doesn't make sense for them.

When Microsoft CSO Howard Schmidt, who had a military and law enforcement background, left to work at the White House, replacement Scott Charney was given the title of "chief security strategist."

Charney oversees security for Microsoft products and talks to the industry and government about security. But the company's physical security is now handled separately.

Experts say it may not make sense to incorporate physical security--of a company's buildings and employees, for instance--and computer security in one job. That's especially true for companies who hire a law enforcement veteran with little computer experience for a job encompassing both.

Still, security needs depend on the industry. For a high-tech manufacturer, for instance, protecting plants from snoopers is akin to protecting intellectual property on a computer. And in large companies, the job is more a political one. The CSO can rely on staff for technical advice.

Another problem is that too many CSOs understand security, but not the overall business.

Part of a CSO's job should be to strike a balance.

At Digital Evolution, based in Santa Monica, Calif., Herring says he knows companies where the security people throw up too many firewalls, shutting down the company's systems too often.

"The people who are in security say, 'That's tough. That's the price of security,"' he said.

Eric Pulier, Digital Evolution's chief executive, acknowledges that hiring a CSO meant some cultural changes in the office. Employees were used to reaching consensus decisions about security.

Pulier still welcomes their feedback, but says the company needed a single, strong voice.

Copyright © 2002 The Associated Press. All rights reserved. The information contained in the AP News report may not be published, broadcast, rewritten or redistributed without the prior written authority of The Associated Press.