The Illusion of Due Diligence

The corporate world says it takes security seriously. The budget says otherwise. As a CISO, my job is to protect corporate information assets while ensuring security obligations are met for the business. That means shareholders, investors, employees, our customers and their interests protected. It means the appropriate level of security for data and data transactions in preventing, detecting and responding to breaches. Regulations have brought information security to the forefront, expanding funding for technologies, staffing and training. The exposures keep coming anyway. Do corporate boards and the C-Level management staff really understand what it takes to secure customer information? Or are they more concerned with perceptions than resolving issues? Being a security professional is a formidable career choice. Security professionals live by a code of ethics, an ethos that demands we do what is right. To do it right you must swear an oath of allegiance to your craft, an oath not welcome in the corporate world that employs you. The very credentials that make you marketable are, in the end, the very thing that can put you in the job market, again, and again. Taking ethical stands to live up to the code of the CISSP and the CISM takes courage, tenacity, thick skin and the willingness to walk away from an employer. What do you do when placed in a potentially compromising position, when ethical behavior, integrity, corporate due diligence and attorney client privilege collide in a cacophony of opinion and negligence? How do you survive when you find yourself in the absolute middle of this vortex? These are true stories: sex videotaped on government servers, the impersonation of a federal officer, embezzlement, threats of physical harm, legal quandaries, and the lies that pass for due diligence. How do you keep your job and maintain personal and professional integrity? Should someone go to jail? Do you violate your own ethical canons to protect yourself? Are you wanted for conspiracy for trying to commit security?