Requires Free Membership to View
When you register you’ll also receive the latest news, advice and technical tips designed specifically for midmarket IT leaders like yourself. Our award-winning editorial team will give you immediate access to emerging business and technology trends.
Scot Petersen, Editorial Director, SearchCIO-Midmarket
acts, and other compliance regulations,
CEOs have been fed a daily diet of compliance and security breach news, as well as advice and horror stories. Executives know that losing data goes well beyond upset customers and embarrassment; it can land them in jail.
 |
||||
|
|
|||
|
||||
"Nobody likes to have their name in the paper" when there's a security problem, added Stephen Fried, vice president of information security and privacy at Metavante Corp., a banking and payments services company based in Milwaukee. "Then you add things like potential jail time for violation of certain regulations and laws, and that has the effect of getting management's attention on security issues."
While today's data breach spotlight has made senior executives more receptive to security initiatives, it doesn't mean freeing money for security projects is easy. Security remains a tough internal sell, and CIOs must reach out to business managers to ensure that security is a priority in every technology project.
The SMB challenge
Security can be a particular challenge for growing companies with limited security resources. Smaller companies face increasing regulatory scrutiny as they transition to publicly held entities. And they may now have larger trading partners and customers with greater due diligence demands.
"There are a lot of regulatory things coming down the pike. The biggest problem for most midrange organizations is keeping up," said Tim Mathews, director of risk management and corporate security for the Educational Testing Service in Princeton, N.J. "The technical part of it is pretty much best practice. The biggest challenge is the myriad contractual obligations and regulatory requirements."
So how do CIOs get the message across to management? CIOs can play up the fear factor in a way that business execs understand. Fried said CIOs must stop proposing security purchases as simply a good thing to do and present initiatives as part of the company's overall product set. "You have to tie your proposal back to what is in the best interest of the organization, whether [it's] retaining customers to making or losing money to keeping folks out of trouble with the law," he said.
"Talk in terms of things they understand," said Scott Megill, enterprise architect and program manager at Philadelphia-based chemicals manufacturer Rohm and Haas Co. Megill implemented single sign-on and identity management programs that include the Passlogix module in Tivoli's security suite.
Megill first approached executives about the project by emphasizing data and access management and intellectual property protection. Their eyes glazed over. And so Megill turned the conversation to single sign-on. As soon as he said the project could eliminate the need for executives to keep 15 usernames and passwords, "their ears perked up," he said. "Then we could start to roll in those other things."
The numbers game
Other CIOs use numbers to make the pitch. CIO Paul Valle of Papa Gino's Inc., a Dedham, Mass.-based chain of 400 pizza shops, saw a potential 3-to-1 return on investment in a security project. Employees were taking security into their own hands by encrypting files like spreadsheets. Problems arose when employees forgot passwords or left the company. Papa Gino's had to re-create some documents from scratch because IT couldn't break through the encryption.
Chris Cahalin, a network manager, learned that the Dell PCs at Papa Gino's, as well as PCs from other suppliers, are equipped with the Trusted Platform Module (TPM). The module can generate secure encryption keys and restrict user-generated keys. TPM could put the keys back in IT's hands.
And so Papa Gino's enabled TPM and brought in Wave Systems Corp.' s Embassy Trust Suite software to manage TPM for the company's 1,700 desktops and notebooks. So far the total cost is $6,900; the estimated savings is $22,000. "Take just the savings in support costs, things like resetting passwords," Cahalin said. "Those calls disappeared because people didn't have to call the help desk anymore."
These kinds of projects help IT build credibility. "Until recently, the CEO and CFO typically were the most difficult people to get support from," Valle said. "Now IT is becoming more of a partner in helping a company succeed."
|
||||
|
|
|||
|
||||
"You have to know the business value of certain assets," Bell said. "Let's say you have gone to the CFO and said, 'What data do you have that you would absolutely 100% hate to have someone else get?' Then you come back to them and say, 'Here's how I can improve protection of these assets.'" Bell's project got the green light, and CWIE deployed SecureWave on 320 systems at a cost of $25-$50 a system. The payback: an 80% decrease in the number of PC replacements in the call center and a decrease in help desk tickets.
Business execs, said Barbara Anson, director of IT security at Baptist Memorial Health Care Corp. in Memphis, "don't need to know all the technical aspects" of a security initiative. "They need to know what the technology means and how it can affect their job either adversely or not."
James Connolly is a contributing technology writer based in Norwood, Mass.
This was first published in June 2007