As security becomes a board-level concern, those in charge of it can no longer hide behind the doors of the IT department.