Find out what is CISO and what are the following security operations they cover. So with that, we will be able to understand who these people are in a company?
Who Are The CISO?
CISO, or Chief Information Security Officer, is a person in a company who is responsible for security. They help design and implement security policies and procedures. Also, make sure that the staff complies with them.
There are various security operations that a CISO can do. We will make a category of it as major and minor responsibility.
Major Responsibilities Of CISO In Security Operations
The major responsibility of a CISO is to design and implement security policies and procedures. It can also be considered as a big part of the work as a security officer. There are various ways to implement security policies and procedures.
The CISO will set up various security policies and procedures. Some of them are related to network security, cyber security, information security, etc.
The goal of this is to make sure that the company’s data is secure. The policies focus on different aspects of cyber security. Such as network security, information security, physical security, etc.
They will set up these types of policies to make sure that it complies with laws. As for the US companies, the US Federal Trade Commission provides a free guideline that they can follow in designing these policies.
So businesses should refer to this guide to set up their policies.
Implementing these policies is not easy. There are various things to take into account in implementing these policies.
So without considering them all, implementing them can lead to problems in the future. These are some of the things that must be considered when implementing these policies.
Minor Responsibilities
The minor responsibility of a CISO is to assess the current state of the business’ security.
- They will evaluate the business’ risks based on its current state. Then come up with a solution or plan for mitigation to reduce it.
- This evaluation will be based on several things. So including previous experiences, research material, etc.
The goal is to make sure that the company’s data are secure against any threat or attack. Especially, if there that may happen in the future or at present time.
For every business type and size, there are different things they must consider in doing this assessment.
For example, businesses that deal with financial transactions must consider HIPAA. It is a health Insurance Portability and Accountability Act compliance while others may not need to consider this at all.
Aside from assessing the current state of business’ security, the CISO also takes part in other security operations.
Such as the following:
- malware incident response and setting up an intrusion detection system (IDS),
- intrusion prevention system (IPS).
IDS is used for detecting attacks or malicious activities.
On the other hand, OIPS is used for mitigating attacks. It is before it causes damage or harm to the company’s data and assets.
Lastly, they also work hand-in-hand with IT staff. Since they need IT support when it comes to setting up different network devices.
Such as the firewalls and intrusion detection systems and intrusion prevention systems (IDS/IPS).
