CSOs lasting longer, but still out after three years

Security chiefs often fall prey to politics

By Tim Greene, Network World
May 23, 2007 11:33 AM ET

. What's this?

LAS VEGAS -- The life span of corporate CSOs is increasing, with the average stay about 36 months, up from 24 months just a few years ago, attendees of CSO Bootcamp at Interop Las Vegas were told this week.

“Now we’re getting business-background guys, and they’re lasting a lot longer,” says John Pironti, the chief information risk strategist for Getronics who ran the bootcamp and was in charge of the security-education track for the show.

But the job is still one where the new person comes in, shakes things up, inevitably causes some bad feelings, and when a better security culture has been started, moves along, he says.

Related Content

The position of CSO was invented as a response to specific security failures at businesses in an effort to tighten up defenses, and they were largely chosen from the ranks of the IT staff. (Read about what it takes to be a great CISO and see the do’s and don’ts for an effective CISO.)

“The first generation was ex-techies,” he says. They were suited to put out the immediate fire that demanded the creation of the job, but not to create self-sustaining work environments that made security a priority - skills that many of the ex-techies lacked.

Even with business skills, these new CSOs have a limited life span because they shake things up so much that politically, their days become numbered, he says. “They spend 24 months getting up and running and 12 months advocating for their next job,” Pironti says.