Evan Schuman's StorefrontBacktalk

Late last month, President Barrack Obama finally named his cyber coordinator, some 10 months after he declared filling the position a priority. The person who was tapped for the position comes to the job with a resume boasting jobs that include chief information security officer at eBay and chief security officer at Microsoft. But the interesting part is how this new job so closely parallels the worst parts of today’s typical retail CIO gig.

The role itself is a spreadsheet of contradictions. White House jobs, especially those senior enough where the President is personally involved in the selection, are highly coveted. And yet, quite a few of the people who were approached for this particular gig rejected it. This position is supposed to get a lot of POTUS face-time. And yet, in a town known for its inflated titles (another czar anyone?), this job title is the underwhelming Cyber Coordinator. Coordinator? That’s the best they could do?

But there’s a serious issue with this gig. Here’s a short excerpt from a wonderful piece in The Washington Post, which spoke with associates of the people who had turned the gig down: “First, you’re not really a czar, reporting as you would to national security adviser Jim Jones and White House economic adviser Larry Summers. ‘What real authority do you have?’ said one of those who demurred. ‘Who’s going to go to Jim Jones and say, ‘This is what you need to do’? ‘Do you have the President behind you?’ Second, ‘It’s a huge, huge turf war. You have Defense fighting the Treasury fighting the [intelligence] groups fighting Homeland Security’ for control, he said.”

Another person in the piece described the job as “bag-holder in chief: if something bad happens, you’re responsible for cyber security, even if you don’t have the authority to pull it off.”

Sound familiar? Let’s see. Would any corporation put an executive in charge of information security but give that exec no direct-report-authority over the various business unit managers whose attitudes and actions will truly dictate how secure the company is?

In many ways, this lack of authority problem nicely encapsulates all of the problems with IT security management today: all responsibility; no authority; not enough money; plenty of blame.

Clearly, some chains handle this much better than others. But the way authority is handed out says so much about corporate priorities. For example, how many chains have heads of human resources who need to sign off before anyone is hired? That HR exec is in charge of enforcing the company’s hiring policies and is given the veto power to guarantee some level of success. There are finance execs who are empowered to refuse to process any check until the purchasing procedures and contract are satisfactory to that individual’s ideals. Or what about a corporate legal counsel who can kill any contract?

But have you ever seen any IT security chief whose signature was required before a customer data project was launched or a new form of payment accepted? The chief may have input. But if a line-of-business exec wants to disregard that advice and proceed, will that indeed not happen? Typically, that security chief may have to go two or more executive levels before getting to a COO or CEO who can overrule that security-reckless exec’s decision, if they want to.

CEOs have started to grasp the idea of the importance of security, but they haven’t internalized it. Once the security chief’s signature is required for passwords to be issued, projects to be approved and programs to be launched (watch out mobile plans!), things get interesting. The real test will happen a couple of weeks later, when the security chief chooses to reject something. The LOB exec who is impacted will appeal that decision, and it will quickly hit the COO’s or the CEO’s desk. That’s when corporate policy will be made. If the security exec is backed up, suddenly, all company managers will change their attitude.

Talking up security is nice. But unless you can live with doing without various programs, it will never be more than talk. Boards and CEOs learned years ago that it pays to back up their chief legal counsel, CFO and the HR boss. They never needed to learn to listen to the head of sales or the head of engineering. How many more disasters will it take before the security lesson is learned? Maybe they need to take Heartland’s heartaches to heart?