Discussion: View Thread

I would appreciate help in identifying research that will help answer a disagreement that has implications for a policy change regarding the appropriate organizational home for cyber security staff.  The organization positions follow---both are plants in the critical infrastructure sector.  

Organization A's Position

Organization A would like cyber security specialists to be assigned to their plant's Security organization. They see the potential for a conflict of interest when an IT organization assigns its own staff members to evaluate and regulate the cyber security of the IT organization's own programs and systems. Anecdotal reports from several plants indicate that IT staff members assigned to perform cyber security assessments are feeling pressure to minimize their evaluation of cyber security risks, particularly for high-visibility programs that are being championed by their IT management. Even if there is no overt pressure to downplay security risks, IT staff members are afraid that raising concerns about existing or proposed programs/systems could negatively impact their annual performance evaluations. As a result, the NRC would prefer that cyber security specialists with security review and oversight responsibilities be assigned to the plant's Security organization. This would allow them to "safely" crack down on IT and operational excesses without fear of management reprisals. Organization A also believes that the plants need to start addressing both physical and cyber threats in an integrated manner and that could best be accomplished by putting both physical and cyber security specialists into the plant's Security organization.

In contrast to the above position, Organization B wants to see cyber security specialists remain in their current IT organizations. There are several reasons for this, including:

(1) many cyber security functions are currently performed by IT staff who have both security and non-security assignments. Placing these staff in the security organization would impact their ability to continue their non-security IT assignments.

(2) at present, the Security organization is focused on its physical security mission and they don't understand or want to take on an additional cyber security mission.

There are also unspoken reasons, involving organizational politics, costs, and control issues -- but these can be addressed elsewhere.

The bottom-line is that Organization B has challenged Organization A to show evidence from "organizational psychology" or other research studies to support Organization A's position that the current placement of cyber security oversight within a plant's IT organization might represent a potential conflict-of-interest.  Organization B wants to see relevant, independent studies before it will accept Organization A's position.

We've been asked to do a quick search to see what 'relevant, independent studies' exist. 

Thanks,  Mary Z.

__________________________________________________
Mary D Zalesny, PhD
Pacific Northwest National Laboratory
1100 Dexter Avenue NE
Seattle, WA  98109 USA
Tel:  206-528-3275
Cell: 206-437-9616 
mary.zalesny@pnl.gov
www.pnl.gov

Hi Mary.

There are a number of issues that stand out when surveying the two points of view.  I am wondering what industry best practices have already been reviewed?  Also, what is the size of the IT organization and is it large enough and mature enough to absorb a discrete operation whose objectives are solely dedicated to mitigating IT security risks such that they are not involved in conflicting matters like those you described below.  What is priority? With regard to the pressure Organization A is feeling such that reports of risk may be minimized, it would seem that a third party IT risk management consultancy engagement might be in order for assessment and facilitation purposes.  If baselines have already been established for this type of risk mitigation operation already someone could come in and assess where they are and determine what it would take to get them to where they want to go?  Once this type of analysis has been completed, short and long range plans based upon risk level can be developed (what is the risk if we do nothing? What is the risk if we wait six months?, etc., etc.).  With regard to the question of centralization or decentralization this depends greatly upon the level of risk ascribed to the different types of access, total number of locations and their proximity, as well as what resources would be required to carry out the IT security objective.  Some of the assessment can be sorted out fairly quickly by a third party depending upon the frequency and depth of past internal audits and the level of risk potential exposures reside upon.  The foregoing is process-driven rather than subjective, as it currently seems to be.

From the literature perspective, there are a number of publications that may offer insight including Information & Management, Decision Support Systems, Computers in Industry and IBM Systems Journal (of course there's Gartner as well).  While the model right for the overall organization may not be discernable from any one literature contribution (i.e. these configurations are highly tailored and specifically designed for that very organization and would not likely be a cookie-cutter type solution without some adaptation) it could be that there are trends contained in these major publications that point to enough similarities in practice that a solution could be fashioned. 

Based upon the level of conflict already inherent in the situation, it would seem that bringing a third-party into the process could potentially diffuse some of the organizational conflict problems already in play.  Issues with power bases and scarce resources could be ferreted out and navigated in an analytical fashion rather than in emotionally charged and potentially engagement damaging ways.  In this case, relying on as much of an objective, systematic analysis is critical. 

Hope this is helpful.

Best regards,

Cori

*******

Colrain M. Zuppo, Doctoral Fellow

PhD in Technology Management,

    Specialization: HRD & Industrial Training

Indiana State University

College of Technology

101 North Sixth Street

Terre Haute, IN 47808