TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

Privacy Perspectives | Should This Be the Era of the Chief Security Privacy Officer? Related reading: On Finding Reasonable Measures To Bridge the Gap Between Privacy Engineers and Lawyers


Privacy and security are meant to work in tandem, so why are they apart?

In most organizations security and privacy fall under separate command, and while they may interact and regularly meet as part of corporate governance and compliance programs, the intersection between the two functions is rarely maximized. In today’s increasingly severe data breach climate and with an avalanche of Internet-of-Things devices entering the workplace, is it time to explore a unified function?

This lack of a unified function was an “aha” moment while Hemma and I pondered about how we can improve the state of cybersecurity through our ongoing collaboration. Hemma is focused heavily on developing both security- and privacy-enabling technologies, while I focus on privacy and governance frameworks. We are at opposite ends of the spectrum, but we see strong dependencies across our work. 

Information-security policies and processes cover confidentiality, integrity and availability as well as protect data, systems and networks. Privacy is a collection of principles and rules that govern how information pertaining to individuals, entities and groups is protected, and it follows that good security and privacy practices depend on each other. Privacy of electronic information would simply not be possible without technology safeguards.   

So why does the chasm between security and privacy still exist today, where a unified program would clearly enable stronger data breach incident response programs, if not prevention?  

Privacy has a very human face, and unlike information-security controls, is less measurable. Information-security practitioners often don’t understand the human side of privacy as they have been geared to think of their universe in a very measured way. In some cases, I have seen enterprise information-security practitioners argue that privacy is a function that has more value in a consumer-based organization. Likewise, privacy professionals may not always understand the implementation of technology controls. For example, we have often seen instances when privacy professionals may think that the act of encrypting a laptop means that the data is safe at all times, when, of course, it’s not.

Traditionally, enterprise organizational structures have encouraged the gap between privacy and security; privacy was aligned with legal, and information security considered an operational function. 

Now we need to find a way to bridge the gap. 

It’s not enough to demand that individuals work together, especially when it’s a cultural gap. It has to start at the top, and that’s why we propose that there be a new combined function: the Chief Security Privacy Officer. 

The executive that fills this role needs to be open to learning and driving a convergence of privacy and security roles and responsibilities. A healthy convergence will take time to arrive at, maybe even years! And, in the process, expect clashes and moments when it feels like the functions are poles apart.

But if you have a strong leader who leads by example, the results could be phenomenal. Just look at the visionary work of Malcolm Harkins, for example. As chief security privacy officer of Cylance, he has carved out a new domain in which data privacy and security operate as two sides of one coin.

When we caught up with Malcolm at RSA, he talked to us about how in his past chief information security officer roles he had deliberately paired privacy and security professionals together on his team. By doing so, he placed an imperative for them to work closely with each other on a daily basis instead of only occasionally interacting at meetings. Malcolm notes that when you take people out of their comfort zone, you have to be prepared to maintain strong executive oversight. He noted that disagreements were healthy and not overheated and in those initial months steered his teams toward the path of mutual understanding followed by consensus. He indicated that you have to allow time for creating relationships, especially those that involve pairing opposite ends of the spectrum.

Malcolm is unambiguous about his goals: “Merging two previously disparate domains enables enterprises to create a culture of trust and assurance around data, with fewer privacy-related incidents as well as products and services which are engineered from the ground up to be both security- and privacy-centric.”

In today’s era, with increased connectivity to the Internet, organizations will want to ensure security. What’s more, end-users have shown increasing concern about online tracking. We talked to Malcolm about how today’s organizations should be thinking about the introduction of wearables in their environment. Malcolm wanted to capture the opportunities presented by wearables but simultaneously manage the risks they bring by casting a broader cross-functional effort.

As a result, his team was able to address the HR privacy concerns of the additional wearable-generated metadata that could otherwise be inferred. By having privacy and security teams work hand-in-hand, it may become the basis for new ways of also managing online identitiesthat increase privacy while maintaining security have now become a high priority for businesses and citizens alike.

Have we reached the point where a chief security privacy officer is an imperative? Perhaps reporting directly to the CEO?


If you want to comment on this post, you need to login.

  • comment Michael • Jul 10, 2015
    Evelyn, I absolutely agree that the CSPO is the right way to go.  There is a risk in having the CSO/CISO role be too technical and not integrated with the privacy and compliance roles.  Larger organizations will still need people focusing on each aspect, but the single executive bringing together the disciplines would be very healthy for an organization.  (I might even change careers for that kind of position!)
  • comment Jim • Jul 10, 2015
    Very interesting. My background is in "Applications Support", and in that and previous IT Manager roles I have been responsible for data security, ICT business continuity etc. In recent years I judged that the gap in knowledge of privacy/ legal/ governance specialists with respect to infotech posed a serious risk to the organisation and I skilled up and gained a Practitioner Certificate in data protection. Armed with that I rolled out a training programme, conducted privacy impact assessments and tightened up on information sharing agreements from the contract to the data stream level. Now I'm taking what I've learned back into the IT arena and shall use my new-found knowledge and experience to drive ISO27001 compliance. I agree strongly with the article and strongle believe that in the 21st century data protection cannot be left to people without IT expertise, nor can data security be left to people without an organisational overview and change management skills - these need to be embodied in the same teams, if not actually (as in my case) the same person.
  • comment Hemma • Jul 10, 2015
    Exactly our thoughts, just take today's news - is the head of an
    organization really were we need these responsibilities to converge - they
    are today, and that's were the terminations/replacements are taking place.
    In some recent situations they have gone down the hierarchy to include the
    CIO and CISO. No accountability of the privacy least not made public that we've seen.  I am so glad that you both - Michael & Jim - agree and are open to championing this mindset.
  • comment Jason • Jul 11, 2015
    I rarely if ever comment on these posts - however I feel compelled to say that my role has been a dual role for at least 3 years now. Reporting to the CIO, I manage both the privacy and security office functions.
  • comment Philippe • Jul 13, 2015
    The scope of my role has evolved since 18 months. From pure CISO I'm now heading to a more mixed job involving compliance and privacy matters. The main reason for that change is actually that... nobody was fulfilling the job.
    Checking if there was a compliant cookie policy on our website (and then write one) or checking if we could give access to personal data to an external developers team or checking if a competitor whose website and data were hacked had the right in the first place to collect those data, etc..., all of this is not in my opinion part of a information security officer's job. But whose job is it? 
    With more and more privacy concerns, small and middle companies will indeed address these issues but they will probably not create new position and will tend to give those responsibilities to people already in the company.
    It was my case. 
    Those issues have always interested me so I already had a good knowledge of the national and European privacy legislation. CIPP/E was by the way an excellent way to consolidate this knowledge base.
    In my opinion, demand for CSPO will greatly increase in the near future but people able to fulfill the role will be "rare birds".
    IAPP has certainly a role to play in the education of ISO/CISO/CSO/CROs... for matters related to legislation and privacy issues. IAPP could also help to build a bridge between them and CPO/DPO/CCOs...