Chief information security officers, already fretting over hackers' increasingly nefarious tactics and regulators penchant for holding individual executives liable for security lapses, have a new worry: that their C-suite colleagues will make them the scapegoat if something goes wrong.