> I think that more and more CISOs are becoming comfortable with the cloud and companies are insisting that CISOs become comfortable. So I always say that given

> I think that more and more CISOs are becoming comfortable with the cloud and companies are insisting that CISOs become comfortable. So I always say that given enough time, we can secure anything and find a way to say yes to it and business-driven CISOs are of that mind. > If a CISO can come up with a list of controls that he/she is comfortable with, then by and large the evidence proves that those controls are working effectively and are going to satisfy the elements of any framework that you use. These are two soundbites from an interview with Susan Mauldin from over a year ago. Someone didn't want us to hear them, according to the timeline[1] of when someone remembered and reported that these interviews happened on September 9, and how soon after (on September 10) they were taken down (and then late last night, at least partially recovered again, further on down in this very HN thread!) They are not even especially damning soundbites if you put them out of context and honestly evaluate them in a vacuum, but it does put some additional context on "it was due to third party code" and in the context of this whole discussion, it is clear why someone did not want us to see this interview. If the job of the CISO is to deliver the project under budget and on time, rather than to do the job correctly as you and I understand it, then we are certainly more likely to find ourselves in this position. So let's keep having these discussions and make it better! It is absolutely your codebase and my codebase, we are all in this kind of trouble (or, we could be... if we all similarly had 140 million involuntary "customers" entrusting us with their SSNs and credit histories.) [1]: https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic...