U.S. Bank CISO: Security Role Expansion Continues, No Single Owner Can Handle It All

Post Views: 7

U.S. Bank CISO Ann Barron-DiCamillo outlines the expanding role of the CISO, emphasizing collaboration across departments and the need for adaptive strategies in cybersecurity.

The Expanding Role of the CISO

Ann Barron-DiCamillo, executive vice president and chief information security officer at U.S. Bank, outlined the expanding scope of the CISO role, emphasizing its integration with areas such as fraud prevention, organizational resilience, third-party risk management, and artificial intelligence governance.

Integration with Fraud Prevention and Resilience

The CISO role has increasingly encompassed domains traditionally separate from cybersecurity, including fraud detection, resilience planning, and AI oversight. Barron-DiCamillo noted that while this expansion reflects the interconnected nature of modern cyber risks, it also presents challenges.

Collaborative Approaches

Cybersecurity issues frequently intersect with multiple organizational functions, making it imperative for leaders to coordinate efforts. Barron-DiCamillo emphasized that effective CISOs foster partnerships with technology, risk, legal, compliance, and business units to align priorities and ensure informed risk decisions.

“No single individual can fully manage all aspects of these responsibilities,” said Barron-DiCamillo. “It requires cross-functional collaboration across technology, risk, legal, and business teams.”

Regulatory Requirements and Incident Reporting

Regulatory requirements for incident reporting have become more stringent, with shorter deadlines. Barron-DiCamillo acknowledged the rationale behind these changes, as early reporting can aid in identifying large-scale threats and supporting affected organizations.

Speed vs. Accuracy

She cautioned against the tension between speed and accuracy. During the initial stages of an incident, organizations often lack complete information, and prioritizing containment and investigation over immediate reporting is critical.

Cybersecurity Spending and Risk Mitigation

Barron-DiCamillo criticized the tendency of organizations to overinvest in compliance measures that merely demonstrate security postures rather than actively mitigating risks. She argued that financial institutions already possess mature control frameworks and understand their risk landscapes.

Focus on Automation and Proactive Measures

The focus should instead shift to reducing risks through automation, asset visibility, identity management, vulnerability management, and secure-by-design engineering. These approaches offer greater impact by minimizing exposure before human intervention is required.

Third-Party Risk Assessments

Barron-DiCamillo noted that while some duplication of efforts is unavoidable, the financial sector has made progress in sharing threat intelligence through groups like the Financial Services Information Sharing and Analysis Center (FS-ISAC) and public-private partnerships.

Collaborative Threat Intelligence

This collaboration allows institutions to leverage collective insights, reducing the need for redundant analyses and enabling faster response to emerging threats.

Academic Observations and Human Factors

In her academic role, Barron-DiCamillo observed that students often enter cybersecurity programs with the misconception that it is purely a technical discipline. Over time, they recognize the critical role of human factors, processes, and decision-making in addressing security challenges.

Shared Responsibility

She emphasized that cybersecurity is a shared responsibility, with security teams providing expertise and guidance while other departments contribute to long-term risk reduction.