How to fashion a 'security first' enterprise

These forward-thinking IT managers are working at dismantling the stereotype of the risk-averse security professional-cum-business foe. How? By showing business colleagues they understand company operations and appreciate corporate goals.

"If security professionals' sole objective was to eliminate risk entirely, no one would have a BlackBerry, no one would have a laptop, and we'd all shred everything the second we read it," says Chad Mead, head of infrastructure security for Global Technology Infrastructure at JPMorgan Chase, headquartered in New York. "But today's business has changed and become much more mobile, so security has to become more of a partner with business."

The need for security pros to tune in to business is not unlike the situation IT experienced about a decade ago, when organizations started thinking about technology as a strategic asset. Then, IT directors learned that presenting technology plans to the board or operational units without emphasizing business benefits was an exercise in futility.

"Businesses have to understand and be willing to listen to security people, but it's up to security managers to coax the business folks along," Mead says. "It's up to security professionals to change perception of security as impediment, and help business managers think of incorporating security upfront."

Security professionals who have operations backgrounds might find changing their mind-sets and becoming a partner to business easier than most. But an operations background is not essential. More important is that security managers get out of their offices and ask questions.

Prime objective

Understanding the business "should be the key objective for any risk manager," says Andre Gold, head of security and risk management for ING Financial Services in Hartford, Conn., and former CISO at Continental Airlines. At ING, as at Continental, Gold says he spent time learning how business operations such as call, distribution and maintenance centers work and measure success. "Once you understand the business, it gives you credibility. You can have conversations about security as a business enabler, not an inhibitor," he says.

Big results can come from small changes. At Akamai Technologies, Andy Ellis, senior director of information security, looks for opportunities to help business workers take small steps toward security.

"I call them 'margin decisions,' where people are on the margin between doing the right thing and not, and I try to help them do the right thing," Ellis says. "You share your vision for where they could be in three, five or 10 years, but give them something real and achievable now."

This approach helps him project the image of adviser, not auditor, Ellis says. Instead of issuing business-unit heads a mandate about where security should be, he works with them on problem resolution. Business leaders like this approach, and keep coming back to him for early involvement in business projects, he says.