Certification - May 2008 - (Page 28) As is the case with many high-level positions, Lohrmann is doing less of the nitty-gritty work and more of the management. About 10 to 15 percent is technical work, while the other 85 to 90 percent is overseeing his staff, communicating with other departments and going to meetings. Because of his job breakdown, Lohrmann has to employ good managerial skills, work as a team player and communicate well, but he also needs to have a thorough understanding of technology to draw upon when needed. When asked if he missed being knee-deep in computer parts, he said “yes” and “no.” “I do miss it sometimes, but I’m providing better value to the state, to the taxpayers, to this organization,” Lohrmann said. “I love making security better for this state [in] innovative, new ways.” corporations because of a regulation under the Health Insurance Portability and Accountability Act (HIPAA). As a result, in 2000, Chuck Klawans became the first information security officer for the Children’s Hospital and Health System in Milwaukee. Although his formal title is ISO, his role is that of a typical CISO. The Future of CISOs When Lohrmann began his career in security, there wasn’t an information assurance track. Now there are programs all around the country, and those studying IT can be trained to become security professionals. Lohrmann said there is and always will be a huge demand for information security in banking and financial institutions, but the need for it in government is just as big. “People don’t have an option when dealing with government. We become a sole source, if you will, for citizens, so we have a lot of their personal information, whether it is tax information or driver’s licenses.” “[The] information security officer has the primary responsibility for coordinating the confidentiality, integrity and availability of information resources,” Klawans said. “How it is defined in any particular organization varies by organization. In my role here, I [am] responsible for doing the back-end work — the analysis, investigation and auditing — to make sure that our security controls are appropriate and doing what they’re supposed to [do]. I also have staff that has the “We hold a lot of information,” he said. “People don’t have an option when dealing with government. We become a sole source, if you will, for citizens, so we have a lot of their personal information, whether it is tax information or driver’s licenses. But I do think all large organizations will have a big need for cybersecurity.” Not Just Government Because of patient medical records, hospitals had information security officers long before most 28 CERTIFICATION MAGAZINE May 2008
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.