![\"Domenico](\"https:\/\/blogs.ethz.ch\/its\/files\/2019\/06\/Domenico_Salvati-838x1024.jpg\")
For Domenico Salvati, Information Security has played a central role in his professional career. His interest in information security began towards the end of his studies in information systems at the University of Zurich, where he wrote his degree dissertation on «Organisational Aspects of Information Security». The final year paper opened the way to his first employment with a large audit firm, where he gained initial experience in the Computer Risk Management Group. He gained further experience on the staff of the CIO at a medium-sized Swiss bank, and this led to him being hired by a major Swiss bank, where he held various roles in the field of information security. The bank later offered him the opportunity to work part-time with its support in order to write a dissertation entitled «Management of Information System Risks».\u00a0 Domenico Salvati then went from the banking world to a job with a major Swiss health insurer, where he served as Corporate Risk Manager.<\/p>\n\n\n\n
What is information security and what does a CISO do?<\/h2>\n\n\n\n
Information security «wants» to\nensure that confidential information remains confidential, that information is\nnot unintentionally and erroneously altered (information and integrity), and\nthat information is available when needed. In many cases, the above-mentioned\nrequirements for the protection of information also stipulate verification\nand\/or traceability, which are particularly important when someone wants to\nmake a payment via e-banking, and prove retrospectively that the payment was\nactually triggered. The «information» part of the term\n«information security» should also indicate that this protection\nshould not be limited to the IT resources of ETH Zurich, but also applies, for\nexample, to information written on paper, and even to the spoken word.<\/p>\n\n\n\n
The ETH Zurich CISO now essentially implements the above-mentioned directive, «Information Security at ETH Zurich» and is the central point of contact for all units (central bodies, departments, and their institutes, as well as teaching and research institutions outside the departments) for all information security issues. It is also important in this context to adhere to the rules of conduct specified in the «ETH Zurich Acceptable Use Policy for Information and Communications Technology (BOT)». In view of the size and complexity of ETH Zurich and the great variety of tasks involved in the role of CISO (see article 5 of the «Information Security Directive»), for each department and for the central bodies and staff, so-called Information Security Officers (ISO) are being appointed, who are on the front line, as the first points of contact.<\/p>\n\n\n\n