What are the Roles and Responsibilities of IT Security?

For many years IT security was seen as just one small part of what IT teams did. Since the explosive growth in cyber attacks for many organizations, this is no longer the case. IT security roles are kept separate from the other roles in IT, recognizing that cybersecurity and IT security require specialist skills and dedicated roles.  In this article, we will examine the roles and responsibilities of IT security and explore some typical cyber security roles.

Roles and responsibilities of security team

Within the field of IT, the roles and responsibilities of security teams tend to focus on the technical aspects of protecting against cyber threats. Other non-IT roles tend to worry about countering the information security threats that aren’t technology-based, such as storing physical documents and securely sending information by post. Providing the functions of information security to an organization has to consider all aspects of information security responsibilities to maintain the confidentiality, integrity, and availability of all data, irrespective of how the data is stored and transmitted.

The individual activities that are included in what are the roles and responsibilities of IT security can vary from organization to organization, depending on factors including:

• The size of the organization.
• It’s structure.
• The technologies in use.
• The type of business. 

This is also true for the information security and cybersecurity roles and responsibilities of an organization. It is important that the individual IT security roles, cyber security roles, and information security roles are all clearly defined, communicated, and understood by all stakeholders. One individual can, of course, take on multiple roles. The roles must be defined so that there are no overlaps in responsibilities. They should be underpinned by an information security roles and responsibilities policy, setting out the rules and controls that are necessary for effective information security.

It is a good idea to publish a well-defined and understandable organizational chart that shows the structure of your IT security team and how it fits within the wider organization. Here are some examples of commonly seen IT security team roles and responsibilities:

Executive Management:

Gaining and maintaining buy-in for IT security from the top of the organization is crucial to success. Not only will this help to secure the necessary funding, but it will also demonstrate to all employees that the organization is taking IT security seriously.  The executive-level roles that are accountable for all aspects of IT security include:

• CISO (Chief Information Security Officer)
• CTO (Chief Technology Officer)
• CRO (Chief Risk Officer)
• CSO (Chief Security Officer)

These roles acting together have the responsibility for ensuring the development and use of an enterprise information security strategy that ensures the protection of all information assets. 

IT Security Professionals:

These roles are responsible for designing, implementing, managing, and maintaining the organization’s security policies, standards, baselines, procedures, and guidelines. Example role titles include: 

• IT security manager.
• IT risk manager.
• IT security analyst.

Users: 

Users are responsible for adhering to the organization’s IT security policy, including preserving the confidentiality, integrity, and availability of assets under their personal control. Users are often the most neglected role in IT security, even though they create the greatest vulnerability to the organization due to cyber-attacks delivered by email and social media.

Data ownership 

IT security can’t operate in a vacuum; it must be part of an overall information security provision. In addition, defining the roles and responsibilities of security team members is not enough to safeguard all data assets. A good information security roles and responsibilities policy will also take into account roles that are specifically concerned with the data. These roles should work with the IT security teams, not in isolation, and include:

Data Owners:

Every element of data should have an owner. For some pieces of data, such as an individual user’s name, the owner will be obvious. It will be less obvious for many other pieces of data that the organization relies on, particularly data used by many different people. Efforts must be taken so that all data has clearly defined ownership. Data owners are responsible for:

• Ensuring that appropriate security is in place for the data.
• Deciding on the sensitivity level for the data.
• Determining appropriate data access privileges.

Data Custodians:

Data custodians are responsible for taking care of data on behalf of the data owners. An example from outside IT is the person that looks after the key to the safe. Within IT security roles, typical data custodians include database administrators and network administrators. 

Documenting IT security roles

Documenting job descriptions helps ensure that all staff understand their roles and responsibilities and contribute to IT security. New staff should undergo induction activities that use the job descriptions to help the employee understand what these responsibilities are and how they fit into the overall information security model.  This is true whether they are taking one of the IT security roles, cyber security roles, or any other role in the organization. IT security can only be as strong as the weakest link, and every employee has a role to play in providing protection against cyber threats. 

The job descriptions for IT security roles, in fact for all roles, should be kept up-to-date, with regular review to ensure that they are still relevant and appropriate. They should also be reviewed following any breach of security as part of a lessons learned activity. 

Organizational charts are a useful way to show how IT security is organized and how it fits with the rest of the organization. Charts are usually depicted as a tree with the highest level roles at the top underpinned by the roles that report upwards. The purpose of these charts is to create an easily understood view of the organization’s hierarchy allowing all employees to understand the lines of authority, relationships between other individuals and teams in the organization, and to who they need to report any issues.

Summary

I hope that this article has given you insight into the roles and responsibilities of IT security teams. Whichever specific roles you choose for your organization IT security has to be seen as a crucial part of your defense against the ever-growing threat of cyber attacks. Creating IT security roles can no longer be done as an afterthought in designing the structure of your IT department. Security has to be at the heart of everything that you do if you want to survive in today’s business environment.

FAQ