The Evolving Role of the CISO: Leading Converged Security Teams in a Cyber-Physical World

The threat landscape facing organizations, particularly critical infrastructure, has fundamentally shifted. The traditional separation between the digital and physical realms is dissolving, giving rise to cyber-physical risks where attacks can pivot between these domains with potentially devastating real-world consequences. In this evolving landscape, the role of the Chief Information Security Officer (CISO) is also expanding, with increasing rationale for CISOs to oversee physical security teams and strategies.

The Blurring Lines and the Need for a Holistic View

The sources highlight the dangerous vulnerabilities created by managing cybersecurity and physical security in silos. Historically, these functions operated independently, with different priorities, expertise, and even vocabularies. However, the increasing interconnectedness of systems, driven by the Internet of Things (IoT) and Industrial Internet of Things (IIoT), has erased this separation.

• Connected devices expand the attack surface: IoT devices within critical infrastructure introduce new avenues for remote exploitation of networks. Weak security in these devices can provide attackers with a foothold to reach critical operational and physical systems.
• Hybrid threats exploit the intersection: Attacks are no longer purely cyber or physical; they are increasingly "hybrid" or "blended", combining elements of both to achieve their objectives. For example, physical intrusion could lead to network access, or a cyberattack could manipulate physical equipment.
• Operational Technology (OT) is a critical link: The convergence of IT and physical security often overlooks Operational Technology (OT), the systems that control physical equipment. Securing OT, which has different priorities like availability and safety compared to IT's focus on confidentiality and integrity, is crucial in a cyber-physical world. Physical security plays a vital role in protecting distributed OT components.

Given these interconnected risks, a holistic security approach is essential. Treating cyber and physical security as separate entities leaves gaps that determined adversaries can exploit.

The Case for CISO Leadership in Converged Security

Positioning the CISO to oversee physical security teams offers several compelling advantages:

• Centralized Risk Management: A CISO with a broad view across both domains can facilitate a more strategic and comprehensive approach to risk management. This allows for better prioritization of threats, allocation of resources, and development of unified security policies.
• Breaking Down Silos: Placing both functions under a single leader naturally encourages collaboration and communication between cybersecurity and physical security teams. This is crucial for understanding and mitigating hybrid threats that span both domains.
• Unified Security Strategy and Vision: A CISO leading a converged team can develop a single, overarching security strategy that addresses the interconnected nature of modern threats. This ensures that protection efforts are aligned and mutually reinforcing, rather than operating in isolation.
• Enhanced Incident Response: When a security incident occurs, a converged team under the CISO can provide a more coordinated and effective response, understanding both the cyber and physical aspects of the attack. This is vital for accurate analysis, containment, and remediation of hybrid threats.
• Optimized Security Investments: A unified budget and strategic oversight can lead to more efficient allocation of security resources, avoiding duplication and ensuring investments are aligned with the most critical risks.
• Improved Regulatory Compliance: A converged approach can streamline compliance efforts by providing a holistic view of security controls across both cyber and physical domains, making it easier to meet increasingly interconnected regulatory requirements.

As Jean-Philippe Bérillon, Head of Security of the DPD Group, suggests, an "integrated governance of security" with a single head is what organizations need to protect people, IT networks, and physical sites. Some organizations are even seeing the benefit of attaching the CISO to the Chief Security Officer (CSO) to further integrate the human behavior aspect of security.

Key Considerations for Hiring and Running Converged Security Teams

For a CISO taking on the responsibility of physical security, several factors are crucial:

• Hiring Talent with a Broader Perspective: When hiring for both cybersecurity and physical security roles, look for candidates who understand the interdependencies between the two domains and possess a willingness to collaborate. Consider individuals with experience in both areas or those who demonstrate a capacity to learn and appreciate the other discipline.
• Bridging the Cultural Gap: Recognize that cybersecurity and physical security teams may have distinct cultures and perspectives. Implement strategies to foster understanding and collaboration, such as cross-training, joint projects, and establishing common terminology.
• Establishing Clear Roles and Responsibilities: Define clear roles and responsibilities within the converged security structure to avoid confusion and ensure accountability. This includes determining who oversees on-site crisis response, policies, standards, and investigations.
• Implementing Joint Risk Assessments and Penetration Tests: Conduct risk assessments and penetration tests that explicitly address hybrid threats and the intersection of physical and cyber vulnerabilities. These exercises can reveal unexpected attack vectors and highlight the need for integrated countermeasures.
• Developing Converged Security Metrics: Implement security metrics that span both physical and cyber domains to provide a holistic view of the organization's security posture and track progress towards integrated security goals.
• Leveraging Technology for Convergence: Utilize security information management systems that are evolving towards Converged Security and Information Management (CSIM), capable of collecting and correlating data from both physical and IT security systems. This provides a unified view of security events and enhances situational awareness.
• Promoting a Security Chain Mindset: Encourage a "security chain mindset" where all individuals and teams involved in security understand their role in the overall protection of the organization and the importance of collaboration.

Conclusion

The cyber-physical threat landscape necessitates a fundamental shift in how organizations approach security. Empowering the CISO to lead converged security teams that encompass both cybersecurity and physical security is a critical step towards building a more resilient and secure future. By breaking down silos, fostering collaboration, and adopting a holistic perspective, organizations can better understand, prevent, and respond to the complex and interconnected threats of the modern era. This evolution of the CISO role reflects the growing recognition that in a connected world, security is not just about bits and bytes, but also about gates, guards, and the intricate interplay between the physical and digital realms.