"My job is not a technical job, though I deal with a lot of technology. I have a more business-practice role," said Jaffe.

Jaffe sees his role as fostering a corporate environment that values security. For example, he holds yearly security training sessions that are mandatory -- even for the CEO.

Jaffe also has a monthly contest pitting his Unix administrators against his Windows administrators to see who has the more secure systems. "What they get out of it is bragging rights, which is a big reward," he said.

Jaffe also uses cracking tools to periodically check the security of employee passwords. If an employee has three weak passwords in a row, they are assigned a new password. "They know they won't like the password I assign them," Jaffe said.

A few years ago, a position like Jaffe's would have been unusual. Today, however, more than 200 companies have chief security officers according to analyst firm Giga Information Group in Cambridge, Mass. While the title shows businesses' increased awareness toward security issues, some may question the need to appoint a CSO. After all, shouldn't the CIO handle security?

Experts say it may be unfair to expect CIOs to shoulder all the weight of security matters.

CIOs tend to know how to create great networks and other infrastructure, but security is probably not their forte, said Sondra Schneider, CEO and founder of Security University, a security training company in Stamford, Conn. "They can build a great house, but they aren't too familiar with locks and home security systems," she said.

In many companies, security is delegated to someone at a lower level. Yet the same executives offloading these responsibilities wouldn't think twice about spending their energies, say, evaluating insurance -- a practice similar in importance to security, Schneider said.

For companies who choose to have a CSO, there is a lot of variation in how that person fits into the corporate hierarchy. Generally, CSOs tend to report to the CIO. Yet in some companies, the CSO is in the upper echelon of management -- on par with the CTO and CIO.

Some companies have adopted other monikers for the position:

Chief Security Architect
Chief Information Security Officer
Security Manager
Corporate Security Officer
Information Security Manager
Additionally, an existing high-level executive can wear the CSO hat along with his or her other titles.

For example, Dave Juitt is both the CTO and the chief security architect of Burlington, Mass.-based Bluesocket, which specializes in securing wireless local area networks. His duties range from supervising security training of personnel to explaining security issues to the board of directors.

Juitt is bilingual in both the language of technology and of business. He can talk about firewalls and intrusion-detection systems with his network people, but he can also discuss how security impacts business needs with the company's board of directors. His job, however, is not to get lost in the technology but to see how it will help the company achieve its business goals.

"You can have the best technology in the world but without education, policy and ongoing testing, you haven't even started," Juitt said.

There's no escaping the fact that having a CSO (or similar position) holds some public relations value for a company. It tells prospective clients or customers that the company is serious about security. Juitt, however, sees this sort of thinking as short-lived.

Over time, people will start to see security as part of business and expect it much like quality and assurance, Juitt said. "There is not a lot of public relations value in a QA department. [Yet,] you are expected to have one," he said.