The year was 1994, and the history-changing event was a computer attack on U.S. financial services company, Citicorp, in June of that year. This incident – now widely viewed as a prime example of a modern cyber attack of any scale against a business – had several elements which eerily predicted the world we live in 30 years later.
During the incident, a hacker stole $10.7 million ($22 million in today’s money) by accessing the dial-up used for wire transfers by several Citicorp clients. At the time, this was shocking and extraordinary. It later transpired that the attacker was a Russian called Vladimir Levin.
But what matters for this article is what happened next. Realising with foresight that the incident indicated a new type of business problem, Citicorp decided to shore up its defences by appointing a man called Steve Katz to lead a new security function. His job title: Chief Information Security Officer, or CISO. This pivotal moment highlights what a CISO means for organisational security and innovation.
Citicorp’s decision to formalise the CISO role reflected a proactive approach to emerging cyber security threats. While the effectiveness of such roles has varied, the function has become indispensable across most large organisations.
Many CISOs have been appointed since 1994, indeed, no organisation of any size would be without the role, but the workload has only multiplied. Equally, without the CISO function, it’s hard not to imagine that cyber security would have deteriorated even more than it has.
The role of the CISO was seen as being about network security and access control. In time, it became obvious that digital access and the Internet had also hugely expanded what was possible. Digital systems were becoming so inter-connected that security represented a new type of business risk, understood today through the modern idea of cyber security.
Discover more: Stay up to date with cyber security trends.