Privacy and security are meant to work in tandem, so why are they apart?

In most organizations security and privacy fall under separate command, and while they may interact and regularly meet as part of corporate governance and compliance programs, the intersection between the two functions is rarely maximized. In today’s increasingly severe data breach climate and with an avalanche of Internet-of-Things devices entering the workplace, is it time to explore a unified function?

This lack of a unified function was an “aha” moment while Hemma and I pondered about how we can improve the state of cybersecurity through our ongoing collaboration. Hemma is focused heavily on developing both security- and privacy-enabling technologies, while I focus on privacy and governance frameworks. We are at opposite ends of the spectrum, but we see strong dependencies across our work. 

Information-security policies and processes cover confidentiality, integrity and availability as well as protect data, systems and networks. Privacy is a collection of principles and rules that govern how information pertaining to individuals, entities and groups is protected, and it follows that good security and privacy practices depend on each other. Privacy of electronic information would simply not be possible without technology safeguards.   

So why does the chasm between security and privacy still exist today, where a unified program would clearly enable stronger data breach incident response programs, if not prevention?  

Privacy has a very human face, and unlike information-security controls, is less measurable. Information-security practitioners often don’t understand the human side of privacy as they have been geared to think of their universe in a very measured way. In some cases, I have seen enterprise information-security practitioners argue that privacy is a function that has more value in a consumer-based organization. Likewise, privacy professionals may not always understand the implementation of technology controls. For example, we have often seen instances when privacy professionals may think that the act of encrypting a laptop means that the data is safe at all times, when, of course, it’s not.

Traditionally, enterprise organizational structures have encouraged the gap between privacy and security; privacy was aligned with legal, and information security considered an operational function. 

Now we need to find a way to bridge the gap. 

It’s not enough to demand that individuals work together, especially when it’s a cultural gap. It has to start at the top, and that’s why we propose that there be a new combined function: the Chief Security Privacy Officer. 

The executive that fills this role needs to be open to learning and driving a convergence of privacy and security roles and responsibilities. A healthy convergence will take time to arrive at, maybe even years! And, in the process, expect clashes and moments when it feels like the functions are poles apart.

But if you have a strong leader who leads by example, the results could be phenomenal. Just look at the visionary work of Malcolm Harkins, for example. As chief security privacy officer of Cylance, he has carved out a new domain in which data privacy and security operate as two sides of one coin.

When we caught up with Malcolm at RSA, he talked to us about how in his past chief information security officer roles he had deliberately paired privacy and security professionals together on his team. By doing so, he placed an imperative for them to work closely with each other on a daily basis instead of only occasionally interacting at meetings. Malcolm notes that when you take people out of their comfort zone, you have to be prepared to maintain strong executive oversight. He noted that disagreements were healthy and not overheated and in those initial months steered his teams toward the path of mutual understanding followed by consensus. He indicated that you have to allow time for creating relationships, especially those that involve pairing opposite ends of the spectrum.

Malcolm is unambiguous about his goals: “Merging two previously disparate domains enables enterprises to create a culture of trust and assurance around data, with fewer privacy-related incidents as well as products and services which are engineered from the ground up to be both security- and privacy-centric.”

In today’s era, with increased connectivity to the Internet, organizations will want to ensure security. What’s more, end-users have shown increasing concern about online tracking. We talked to Malcolm about how today’s organizations should be thinking about the introduction of wearables in their environment. Malcolm wanted to capture the opportunities presented by wearables but simultaneously manage the risks they bring by casting a broader cross-functional effort.

As a result, his team was able to address the HR privacy concerns of the additional wearable-generated metadata that could otherwise be inferred. By having privacy and security teams work hand-in-hand, it may become the basis for new ways of also managing online identitiesthat increase privacy while maintaining security have now become a high priority for businesses and citizens alike.

Have we reached the point where a chief security privacy officer is an imperative? Perhaps reporting directly to the CEO?