Skip to content
BOL Conferences
Thread Options
#129581 - 11/07/03 02:24 PM Security Officer Positions
Anonymous
Unregistered

Can someone tell me if there is any distinction between the titles of "information" security officer and "data" security officer. I realize that the same person can be assigned both positions, however, it seems that the "data" security position would require more technical knowledge. What do you think?

Return to Top
Security - PUBLIC
#129582 - 11/07/03 05:18 PM Re: Security Officer Positions
incandescent Offline
100 Club
incandescent
Joined: Oct 2003
Posts: 125
Quote:

Can someone tell me if there is any distinction between the titles of "information" security officer and "data" security officer. I realize that the same person can be assigned both positions, however, it seems that the "data" security position would require more technical knowledge. What do you think?




I believe that there is with the Data Security Officer or Information Systems (Processing) Security Officer, e.g. network, PC access, etc., separated from other kinds of information security and privacy issues, e.g. files on desks, open file cabinets, access to non-public areas, third-party access to customer information, etc.

In addition, there is the real Security Officer position that must be established (per regulation) to deal with asset and people security issues.

Return to Top
#129583 - 11/07/03 05:18 PM Re: Security Officer Positions
Anonymous
Unregistered

They are the same. It is a matter of style. The term "data security" is an older mainframe-era description of the function, which generally meant that the individual promoted or administered the protection of physical, administrative, and technical safeguards over the computing environment and the application systems -- at that time almost exclusively a large-scale mainframe environment.

As computing applications moved from, or embraced, file server systems, desktops, and became more distributed, the "information security" moniker was more frequently used. EDP security became information security, or "IS security" and, more often, "IT security", for information technology security. With the ability to move information through all platforms (e.g., from Windows desktop applications through Internet attachments, and back to desktops)the risk was enterprisewide, and the requirement was to protect ALL information resources. The determination of the function's technicality is more frequently defined by the position's suffix; i.e., whether the individual is a "specialist", an "analyst", an "officer" -- versus the more technical title of "engineer".

Referencing the position with the term "data security" would appear to be a term not used as frequently today. If you were to go to Monster.com and type in "information security", you'd see literally hundreds of posts; if you typed "data security", I think you'd find only a handful still using this title. Good luck.

Return to Top
#129584 - 11/10/03 08:01 PM Re: Security Officer Positions
incandescent Offline
100 Club
incandescent
Joined: Oct 2003
Posts: 125
Quote:

They are the same. It is a matter of style.




No, they are different with a different set of skills required.

Return to Top
#129585 - 11/10/03 09:47 PM Re: Security Officer Positions
Risk Officer Offline
100 Club
Joined: Apr 2001
Posts: 205
Dallas
Quote:

Quote:

They are the same. It is a matter of style.




No, they are different with a different set of skills required.




It all depends upon how you define the positions. They could be the same...they could be different. In many instances, the usage of "data" has migrated into "information." For example, from a regulatory perspective, Electronic Data Processing (EDP) changed to Information Systems (IS) and was then changes to Information Technology (IT). The new FFIEC handbook, Information Security, replaces much of what was referred to in the old handbooks as data security.

Conversely, you could use Data Security to refer to more technical issues (i.e. firewalls, passwords, network security, etc.), and Information Security could actually be limited to requirements under Gramm-Leach-Bliley.

More important than splitting hairs over particular titles is to make sure you have all the necessary roles / duties defined and assigned. You can call them whatever you want.
_________________________
My opinions are just that...my opinions.

Return to Top

Moderator:  Andy_Z