CDO vs CIO vs CISO

CDO vs CIO

Theo trang CIO.com, 2 vị trí này có trách nhiệm khá rõ ràng phân biệt. Nôm na, 1 bên lo cái xô, 1 bên lo đổ nước. Trích [1]:

“The difference between the CDO and CIO in my mind is quite clear, and I often use the analogy of the bucket and the water,” Carruthers says. “The chief information officer is responsible for the bucket. They’re responsible for making sure that the bucket is the right size, that there are no holes in it, that it’s safe, and that it’s in the right place. 

The chief data officer is responsible for the fluid that goes in the bucket, comes out of the bucket, that it goes to the right place, that it’s the right quality and the right fluid to start with. Neither the bucket nor the water work without each other.”

CISO vs ??

Chỉ có Security sẽ lo cả phần secure cho cái xô, cũng như phần nào đó, cũng phải kiểm soát việc nước nôi đó được múc từ cái xô đến chỗ nào khác!! :))

À còn nữa, rất có thể, CISO sẽ định nghĩa cả workflow, và cả việc giám sát kiểm soát vụ nước nôi đem đổ khỏi xô, xem nước nôi đó có phù hợp hay không nữa. Đại loại theo term, nó là Data Governance.

Tuy nhiên theo IDC, CDO sẽ làm:

• Governance: Advising on, monitoring, and governing enterprise data
• Operations: Enabling data usability, availability, and efficiency
• Innovation: Driving enterprise digital transformation innovation, cost reduction, and revenue generation
• Analytics: Supporting analytics and reporting on products, customers, operations, and markets

Nên nếu các enterprises làm theo tham vấn của IDC, CISO sẽ phần nào nhẹ gánh. Nôm na, 1 số enterprises đó sẽ quan niệm information security = cyber security.

Peace!!

----

[1]: https://www.cio.com/article/230880/what-is-a-chief-data-officer.html , By Minda Zetlin and Thor Olavsrud - CIO SEP 28, 2020 3:00 AM PDT.

A good security article: "6 Cyber-Defense Steps to Take Now to Protect Your Company"

6 Cyber-Defense Steps to Take Now to Protect Your Company

Daniel Spicer is Chief Security Officer at Ivanti. 

https://threatpost.com/latest-insights-ransomware-threats/178391/  

1 số nội dung trích lọc

Step 1: Get Complete Asset Visibility

You can’t manage and secure what you can’t find. Invest in an automated platform that enhances visibility into all connected devices and software and provides context into how those assets are being used, so your IT and security teams can make better decisions. A comprehensive discovery initiative finds all assets on a network, including both corporate-owned and BYOD devices, and then provides context around who is using what device, how and when they’re using that device, and what they have access to. ...

Step 2: Modernize Device Management

...A unified endpoint management (UEM) approach fully supports bring-your-own-device (BYOD) initiatives while maximizing user privacy and securing corporate data at the same time.

...

Step 3: Establish Device Hygiene

...Good device hygiene involves taking a proactive, multi-layered approach to ensure that only devices meeting defined security requirements are allowed to access business resources, thereby reducing the digital attack surface. ...

Step 4: Secure Your Users

...The ideal solution: Passwordless authentication via zero sign-on. Instead of passwords, this approach uses multifactor authentication via alternative authentication methods such as possession (what you have, like a mobile device), inherence (biometrics like fingerprints, Face ID, etc.) and context (location, time of day, etc.).

Step 5: Provide Secure Access

...SDP still requires a layer of security to maximize benefits, which is where zero-trust network access (ZTNA) comes into play.

Step 6: Continuously Monitor & Make Improvements

...To stay in compliance and mitigate threats, it’s imperative to get a handle government, risk and compliance (GRC) management. Look for a solution with quick and easy regulatory documentation imports to map citations with security and compliance controls, and seek to replace manual tasks with automated repetitive-governance activities.

------

PS. Tin tức về 1 giải pháp UEM của Ivanti https://www.ivanti.com/lp/uem/reports/2021-gartner-magic-quadrant-for-uem (được đánh giá Visionary, chưa phải Leader theo Gartner)