Organizational Roles and Responsibilities in Security
In a secure environment, organizational roles play a critical part in the implementation and administration of security measures. These roles are not always explicitly defined in job descriptions, but they are essential in establishing a communication and support structure that facilitates the deployment and enforcement of security policies.
The following are common security roles in a typical organization:
Senior Manager
The Senior Manager is the individual ultimately responsible for an organization’s security. This person must authorize and support the security policy, ensuring that it is effectively implemented. While they may not be involved in the day-to-day operations of security, the senior manager exercises due diligence and due care in overseeing the protection of the organization’s assets.
- Responsibility: Ultimate authority over security policies and liable for the success or failure of security measures.
- Delegation: Security professionals handle implementation, but the senior manager makes the critical decisions.
Security Professional
The Security Professional (or InfoSec officer) is a trained and experienced engineer responsible for implementing security measures according to the directives set by senior management. This role focuses on the technical aspects of security, such as writing and implementing security policies.
- Responsibility: Design and implement security solutions based on approved policies.
- Delegation: They follow instructions from senior management and are not decision-makers.
Asset Owner
The Asset Owner is tasked with classifying information and ensuring its protection within the security infrastructure. Typically a high-level manager, the asset owner delegates actual data management tasks to a custodian.
- Responsibility: Classification of data and ensuring its proper protection.
- Delegation: The custodian handles the day-to-day management of data.
Custodian
The Custodian is responsible for implementing the prescribed security measures and managing data protection. They perform tasks such as data backups, integrity checks, and deploying security solutions.
- Responsibility: Protect the confidentiality, integrity, and availability (CIA Triad) of data.
- Tasks: Perform backups, validate data integrity, and manage data storage according to classifications.
