POSITIONING CYBERSECURITY IN THE C-SUITE: HOW TO BUILD A JOINT SECURITY OPERATIONS CENTER

ABSTRACT

This paper argues that the creation of a Joint Security Operations Center (JSOC) must be coordinated, implemented, and administered by a single dedicated entity, one that operates at the highest level of organizational authority to ensure proper coordination and enforcement. Currently, not one sector in the U.S.’s national infrastructure have yet to come up with an effective strategy or a coherent scheme to protect itself from a concerted cyberattack. Therefore, it is critically important that we begin to get our act together in cyberspace. Electronic, personnel, and physical security are separate operations in most companies. So, in essence, the separation of functions has created three wobbly one-legged stools instead of one solid three-legged stool. Thus, we need a single unified point to create and manage a complete, rational, organization-wide cybersecurity control system. In essence, a complete cybersecurity response requires expertise in electronic, behavioral, and physical security operations and the key to success lies in the proper placement. The obligation for creating and sustaining this strategic function lies with corporate leadership, not the people down the organizational ladder in IT. The converged approach is essential because monitoring and enforcement is cross functional and comprehensive.

Additional information

Notes on contributors

Dan Shoemaker

Daniel P Shoemaker, Ph.D., is principal investigator and senior research scientist at the University of Detroit Mercy’s Center for Cyber Security and Intelligence Studies. Dan has served 30 years as a professor at UDM with 25 of those years as department chair. He served as a co-chair for both the Workforce Training and Education and the Software and Supply Chain Assurance Initiatives for the Department of Homeland Security, and was a subject matter expert for the NICE Workforce Framework 2.0. Dan has coauthored seven books in the field of cybersecurity and has authored over one hundred journal publications. Dan earned his PhD from the University of Michigan.

Gregory Laidlaw

Greg Laidlaw, DMIT, CISSP, C|EH, serves as the Chair and is a Lecturer in the Cybersecurity & Information Systems Department at the University of Detroit Mercy. Greg’s research focuses on secure systems, human factors in security, and design usability. Prior to transitioning into full-time academia in 2011, Greg developed an extensive range of technical and managerial experience from 25 years of IT consulting in small enterprise and local government organizations. Greg utilizes his expertise in programming, network infrastructure and database design, system security, and data integration in the classroom and was instrumental in the formation and leadership of the student-led Detroit Mercy Cybersecurity Club. Greg earned his Doctorate of Management Information Technology from Lawrence Technological University and Master of Science in Finance from Walsh College.

Anne Kohnke

Anne Kohnke, Ph.D., is an Associate Professor of Cybersecurity in the Cybersecurity & Information Systems Department at the University of Detroit Mercy. Anne’s research is focused in the area of cybersecurity, risk management, threat modeling, and mitigating attack vectors. Anne has recently coauthored five books in this field of study with a sixth book due out in print in March 2020. Anne earned her PhD from Benedictine University, an MBA from Lawrence Technological University, and is currently pursuing a Master of Science in Information Systems and Technology at the University of Michigan Dearborn.