Title: Positioning and Staffing the Security Function
Course: IN 2001 Principle of Information Assurance > Section: Module 11: Chapter 11

Positioning and Staffing the Security Function
1. In his book, Information Security Roles and Responsibilities Made Easy, Charles Cresson Wood indicates that the security function can be placed within the following organizational functions:
  - IT function, as a peer of other functions (networks, applications development and help desk)
  - Physical security function, as a peer of physical security or protective services
  - Administrative services function, as a peer of human resources or purchasing
  - Insurance and risk management function
  - Legal department
2. The challenge is to design a reporting structure for the information security function that balances the competing needs of each community of interest.
3. Organizations find compromise by placing the information security function where it can best balance its duty to enforce organizational policy with its ability to provide the education, training, awareness and customer service needed to make information security an integral part of the organizational culture.

Staffing the Information Security Function
1. Selecting information security personnel is based on a number of criteria, including the principles of supply and demand.
2. Many future IS professionals seek to enter the security market by gaining the skills, experience, and credentials they need to qualify as a new supply.
3. Until the new supply reaches the demand level, organizations may pay the higher costs associated with limited supply.
4. Once the supply meets or exceeds the demand, the organizations that are hiring these individuals become selective, and the amount they are willing to pay drops.
5. At the present time, the information security industry is experiencing a period of high demand, with few qualified individuals available for organizations seeking their services.
6. Qualifications and Requirements
  - There are a number of factors that influence an organization’s hiring decisions. In many organizations, information security teams lack established roles and responsibilities.
  - For the information security discipline to move forward, these factors must be addressed:
  - Management should learn more about position requirements and qualifications for both information security positions and IT positions that impact infosec
  - Upper management should also learn more about the budgetary needs of the infosec function
  - IT and management need to learn more about the level of influence and prestige the information security function should be given in order to be effective
7. In most cases, organizations look for a technically qualified information security generalist who has a solid understanding of how an organization operates.
  - In many other career fields, the more specialized professionals become, the more marketable they are
  - However, in the information security discipline, overspecialization is often a risk
  - It is important to balance one’s technical skills with general information security knowledge
8. When hiring information security professionals, organizations frequently look for individuals who understand:
  - How an organization operates at all levels
  - That information security is usually a management problem and is seldom an exclusively technical problem
  - How to work with people and have strong communications and writing skills
  - The roles of policy, education and training
  - The threats and attacks facing an organization
  - How to protect the organization from attacks
  - How business solutions can be applied to solve specific information security problems
  - Most mainstream IT technologies (not necessary as experts, but as generalists)
  - The terminology of IT and information security
9. Entry into the Information Security Profession
  - Many information security professionals enter the field through one of two career paths:
    - First, ex-law enforcement and military personnel are often involved in national security and cyber-security tasks and move from those environments into the more business-oriented world of information security
    - Second, technical professionals find themselves working on security applications and processes more often than on traditional IS tasks
10. Today, college graduates and upper-division students are selecting and tailoring degree programs to prepare to work in the field of information security.
11. The current perception of information security is that a security professional must first be a proven professional in another field of IT.
12. IT professionals who move into information security, however, tend to focus on the technology—sometimes in place of general information security issues.
13. Organizations can foster greater professionalism in the information security discipline by establishing clearly defined expectations and position descriptions.
14. Information Security Positions
  - The use of standard job descriptions can increase the degree of professionalism in the information security field as well as improve the consistency of roles and responsibilities among organizations
  - Organizations that are revising the roles and responsibilities of information security staff can consult Wood’s book, Information Security Roles and Responsibilities Made Easy, or Schwartz, Erwin, Weafer, and Briney’s report, “Information Security Staffing Help Wanted.” The following is an excerpt from this report:
    - “Definers provide the policies, guidelines and standards… They're the people who do the consulting and the risk assessment, who develop the product and technical architectures.  These are senior people with a lot of broad knowledge, but often not a lot of depth… Then you have the builders. They're the real techies, who create and install security solutions…You have the operators who run and administrate the security tools, the security monitoring function, and the people who continuously improve the processes.  This is where all the day-to-day, hard work is done.  What I find is we often try to use the same people for all of these roles.”
15. Chief Information Security Officer
  - This position is typically considered the top information security officer in the organization.  The CISO is usually not an executive-level position and frequently reports to the Chief Information Officer
  - Though CISOs are business managers first and technologists second, they must also be conversant in all areas of security, including the technical, planning and policy areas
  - The CISO performs the following functions:
    - Manages the overall information security program
    - Drafts or approves information security policies
    - Works with the CIO on strategic plans, develops tactical plans, and works with security managers on operational plans
    - Develops information security budgets based on available funding
    - Sets priorities for the purchase and implementation of information security projects and technology
    - Makes decisions or recommendations on the recruiting, hiring and firing of security staff
    - Acts as the spokesperson for the security team
  - The most common qualification expected for this type of position is the Certified Information Systems Security Professional.  A graduate degree in one of the following areas is also often required: criminal justice, business or technology
  - To qualify for this level position, the candidate must demonstrate experience as a security manager and present experience with planning, policy and budgets
16. Security Manager
  - Security managers are accountable for the day-to-day operation of the information security program. They accomplish the objectives that are identified by the CISO and resolve issues that are identified by technicians.
  - Within the information security community, there are a number of positions with titles that contain the word manager or other language that suggests management responsibilities, but only those people who are responsible for management functions, such as scheduling, setting relative priorities or administering budgetary control, should be considered true managers
  - Candidates for this position often have a CISSP.  Traditionally, managers earn the CISSP and technical professionals earn the Global Information Assurance Certification.
  - Security managers must have the ability to draft middle- and lower-level policies as well as standards and guidelines.  They must have experience in traditional business matters, including budgeting, project management and hiring and firing. They must also be able to manage technicians, both in the assignment of tasks and in the monitoring of activities
17. Security Technician
  - Security technicians are the technically qualified individuals who configure security hardware and software and coordinate with administrators to ensure that security is properly implemented
  - A security technician is often offered as an entry-level position; however, some technical skills are usually required to be hired in this position
  - Just as in the networking field, security technicians tend to be specialized, focusing on one major security technology group and further specializing in one software or hardware package within the group
  - If a security technician wants to move up the corporate hierarchy, he or she must gain an understanding of the general organizational issues related to information security
  - The technical qualifications and position requirements for a security technician are varied.  Organizations prefer the expert, certified, proficient technician.  Regardless of the area, the particular job description includes some level of experience with a particular hardware and software package. Sometimes familiarity with a technology secures an applicant an interview; however, experience in using the technology is usually required