Heathrow CISO claims basic security issues overlooked

The chief information security officer (CISO) for Heathrow Airports Limited, Mark Jones, has claimed that the fundamentals of information security are  regularly overlooked.

Jones explained that policies for making sure software is updated regularly, maintaining resilience with information systems and managing security incidents are just some of the basics that are forgotten about. He highlighted how they play a pivotal role in environments with a critical IT-based infrastructure, such as Heathrow Airport.

Patching , although a straightforward concept, is too often neglected, according to Jones. He said that many organisations outsource services in an effort to maintain the infrastructure of their IT systems and are, in numerous cases, reluctant to monitor patching to a high standard.

Jones identifies resilience as another key component overlooked, but states that it is not the responsibility of CISOs, who may lack the authority needed to ensure this is done correctly and to the required standards. Jones explained:

“CISOs need the capability to influence the executive team, but are often seen only as subject matter experts and not taken seriously enough by business executives.”

He believes that organisations should ensure that future CISO candidates possess commercial responsibility experience. Jones continued:

“We are moving into a world where digital information is so important, so there will be significant rewards for CISOs who are respected advisors to the board.”

Within the next 15 years, Jones predicts an increasing demand for technical, business savvy CISOs. He believes that companies should save money and develop people, rather than purchase unnecessary technology.

Source: http://www.computerweekly.com/news/2240213215/Security-basics-overlooked-says-Heathrow-CISO