Colorado gets a cyber security leadership 'attaboy'

1

By Andy Bochman

Sorry, but I was a little slow on the uptake on this one. Not an exemplary blogger, am I, that's for sure.

But self flagellation aside, I want you to know that there's at least one U.S. state out there that's done what myself and others have been urging for large utilities. Namely, appoint and empower a CSO or CISO (Chief Information Security Officer) with enterprise-wide policy setting and enforcement authority.

For Colorado, that's Travis Schack, who's at the helm as CISO. It's important to note that Colorado didn't have to make this position; it chose to. That's right, and it was neither regulator nor competitive pressure that drove this decision. Colorado has a CISO because it thinks its operations require one, and its citizens deserve one.

Weird, huh?

Well check this out, from Travis's own blog, and you'll see that he's asking questions near and dear to our sector right now. Of government agencies he asks:

... do you have a data classification process in your organization? Do you know what systems process, store, and/or transmit each type of data within your organization? Do you know who has access to each type of data, where is the data being accessed from, when is the data being accessed, and what is being done to your data?

Ahem and Amen. Nice job, Colorado. And thanks to the Center for Digital Government for shining a light on these folks.

Andy Bochman is author of the Smart Grid Security Blog and an Energy Security Lead for IBM's Rational division, where the focus is on securing the software that runs the smart grid. Andy is a contributor to industry and national security working groups on energy security and cyber security. He lives in Boston, is an active member of the MIT Energy Club, and is the founder of the Smart Grid Security and DOD Energy Blogs.