Opinion

Well Covered

How to deal with executives who are interested only in their own backsides

By Bob Bragdon, Publisher, CSO

December 21, 2007 — CSO — Let’s be honest, shall we? How many people do you encounter every day whose sole actions are to make sure they are covered?

First, let me make the distinction between the type of CYA I am talking about here, the standard level of communication that is made with corporate leadership so that it is aware of what is being done, why it is being done and the value that it delivers to the organization. This latter kind of communication is just “selling up” and it is something that every CSO is doing or should be doing. That’s part of how you ensure the success of your risk management endeavors.

What I am really talking about here—true butt covering—is something far more disturbing.

We’ve all seen CYA in security and corporate leadership at some point or another. Leaders go through the motions of putting measures in place that create the appearance of good security. Their actions may provide some legal or technical protection, but in fact they are just providing lip service. I would wager that every security professional has encountered one of these “leaders” at some point in his or her career.

In my humble opinion, the most egregious type of CYA is the business leader who pulls together a cross-functional “security team” that includes security leadership, line of business leaders, human resources and so on, but has no intention of actually acting on that team’s recommendations. It makes every part of the organization feel involved in the process but it accomplishes absolutely nothing. Wait, scratch that. It does accomplish something: It makes the organization feel more secure when in reality it is less secure.

CYA is a state of mind that cannot be tolerated in security. There is too much at stake. Here in the pages of CSO, on our website CSOonline.com and at our numerous events, we cover these stories every day. We also hear the horror stories of organizations that weren’t prepared when something bad happened. It’s like the business that opens a job search for a CSO, but really just wants to pick the interviewee’s brain about how to fix the company’s security problems. Without hiring anyone, it creates the impression that it’s trying. It might even take the knowledge it has gained and try to put the easy parts to work. Unfortunately, managing risk isn’t as simple as putting up nice new drapes and adding a fresh coat of paint.

My advice when you encounter a CYA executive: Train him so that he understands the issues and risks. If that fails, go around him. Security is a journey and not a destination. And it’s for people who are serious about it.