The late 1980s was an exciting time to be a CIO in higher education. Computing was being decentralized as microcomputers replaced mainframes, networking was emerging, and the National Science Foundation Network (NSFNET) was introducing the concept of an "internet" to hundreds of thousands of new users. Security wasn't much of an issue; the big debate on campus was whether to regulate access to the alt.sex newsgroups. An institution's systems group handled IT security as an afterthought. No one had a "chief information security officer" (CISO)--or anything like it. Now, two decades later, cyber security is routinely identified as the top concern of higher education CIOs, according to the Campus Computing Project's "2006 National Survey of Information Technology in US Higher Education." And with good reason: The CDW-G "Higher Education IT Security Report Card 2006" indicates that 56 percent of all higher education institutions have experienced at least one security incident in the last year. The role of the CISO is evolving from a technologist responsible for computer systems administration, to someone with campuswide responsibility for information security policy, regulatory compliance, and financial tradeoffs, as well as technically oriented computer/network security and incident response. The author contends that regardless of how information security is organized, the function is only going to grow in importance and institutions must develop strategies for addressing new security challenges. Information security as an afterthought is no longer a viable option.