5 ms·

Their security head was a music major, with little or no experience in the field. https://www.nbcnews.com/business/consumer/equifax-executives-step-down-scruti

by adekok 9y ago

Their security head was a music major, with little or no experience in the field. https://www.nbcnews.com/business/consumer/equifax-executives-step-down-scrutiny-intensifies-credit-bureaus-n801706 https://www.nbcnews.com/business/consumer/equifax-executives...

ceejayoz 9y ago
Many of us don't have formal credentials in computer science or security. There are plenty of reasons to go after Equifax, but someone's college major from decades ago isn't one of them. https://www.washingtonpost.com/news/the-switch/wp/2017/09/19/equifaxs-top-security-exec-made-some-big-mistakes-studying-music-wasnt-one-of-them/ https://www.washingtonpost.com/news/the-switch/wp/2017/09/19...
- v64 9y ago
  I agree that having an unrelated background doesn't entirely disqualify a person from a position, but when the consequences of failure are high and more money is at stake, then selection should be much more stringent. She probably would be a great fit for that position at 99% of the companies in the country, but with Equifax's position and data, someone with a more extensive background in security would be preferable.
  - ceejayoz 9y ago
    My understanding is her past roles included security work at HP, First Data, and Sun Trust. Equifax doesn't appear to have wandered into an orchestra practice and said "anyone wanna help run security?" Yeah, she fucked up. No, it wasn't because of her college major.
    - FilterSweep 9y ago
      I don't think it was the college major, true, but it appears she enjoyed a large scale of "falling up" into that position that most people in our industry aren't afforded.
      - ceejayoz 9y ago
        "It appears"? From what, her LinkedIn? What concrete information do we have to make that conclusion?
        FilterSweep 9y ago
        The total mismanagement of customers and expectations after the hack. It would be naive to say the just the clear oversights in management were solely to blame - you can do everything right and still have data breaches. Far more intricate attacks could be perfected had the current vulnerabilities been resolved. You can argue "its a big company" all you want and that the responsibility shifted. However, at that position, setting up a shoddy website where customers can see if they were impacted, then request/pay for their own credit freeze, is NOT SUFFICIENT handling of the situation and betrays a long historied past of never having to had handle a situation so grave. Lives and livelihoods are at stake here. This isn't just a senior software engineer or technical director job where messups only breach trust. A crappy application developer could release buggy software, but one can "delete the app" at the end of the day. You can't uncork this bottle. This is a security position over some of the most personal data available on US citizens. If there is ANY belief that this person "fell up" through a security role, that needs to be identified.
    - v64 9y ago
      Her LinkedIn profile, before it was scrubbed, showed her as an employee of those companies, but her job title for each was listed as "Professional". It's not entirely clear what her previous roles were and exactly how relevant they were to the role of Chief Security Officer. It's the same divide between self taught developers and developers with a formal computer science background. If I'm hiring someone to make a website, then it may not make much of a difference, but if I need them to write kernel device drivers, more often than not your best bet is going to be with someone with a formal background who has had to demonstrate at school that they have certain knowledge prerequisites in a standardized setting. I can't speak for the cybersecurity at HP, Sun Trust, and First Data. It's possible they have great records, or it's possible they've made mistakes and gotten away with them, and these experiences led Mauldin to believe Equifax was more secure than it was. Edit: I found that she was Group VP at SunTrust from 07-09 and Senior VP and Chief Security Officer at First Data from 09-13. Her experience at First Data is relevant to the discussion and it's strange that the Washington Post article you linked to didn't mention that.
      - abiox 9y ago
        several people i've worked with graduated from respected CS programs yet could barely program their way out of wet paper bag. the best people (engineering-wise) i've worked with are people who had a passion for the subject, were generally inquisitive sorts, and engaged in a lot of self-directed learning and research because they simply wanted to... some had degrees, and some were high-school dropouts.
        v64 9y ago
        > several people i've worked with graduated from respected CS programs yet could barely program their way out of wet paper bag How do you reconcile the fact that the individual could barely program, but they graduated from what you consider respected CS programs? Or are you saying that the programs have a public perception of respect that you personally don't believe they deserve? If the person passed that institution's examinations, then it seems to me that you're indicating either the institution has low standards compared to your industry or that they erroneously passed someone who did not meet their standards (either through incompetence or deception). I think it's relevant to note if the individuals graduated with a high GPA or if they barely scraped by. Of course autodidactism exists, but it can be very difficult to judge an individual's abilities based on one interview alone. A degree from a university at least indicates that the individual was exposed to the subject matter for a number of years, tested by individuals in the field who themselves have advanced credentials in the field, and passed the institution's examinations of knowledge. This isn't to say they're better qualified, but it gives you information that's more difficult for an individual to mislead you with. I can safely assume that a university has taken the expected precautions to ensure an individual's grades and credentials are reflective of their own work, as opposed to a self taught developer showing me a portfolio that may or may not be their original work entirely.
- woranl 9y ago
  I don't have formal credentials in medicine, but I know how to hold a knife. Will you trust me to do a surgery on you?
  - deleted 9y ago
    [deleted]
  - ceejayoz 9y ago
    There are plenty of doctors who majored in music.
    - woranl 9y ago
      Those doctors have formal credentials. Does Equifax security head have the equivalent formal credentials? Anyone can get to top position if they know who and how to suck up.
      - ceejayoz 9y ago
        What are these "equivalent" formal credentials for security?
  - dredmorbius 9y ago
    Thirty years ago not only did modern computer security concepts not exist, and not only were there no programmes in them, but odds are good that "computer science" was part of the maths department. The first computer science department dates to 1962 at Purdue University (home of Eugene "Spaff" Spafford). Others formed generally during the 1970s and 1980s.
    - woranl 9y ago
      Last I checked, the leak was not thirty years ago.
      - dredmorbius 9y ago
        The degree was. And on-the-job experience is a thing. Your responses strongly suggest a failure to grant charitable consideration: Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
dahart 9y ago
FWIW, it's well known that high/surprising numbers of computer scientists have a music background. Some people think it's because the subjects are fundamentally similar. Do you know the story about the famous actress Hedy Lamarr, who invented a channel switching anti-jamming system for torpedos with a friend? Both were musicians with little or no experience, and their invention, aside from being patented and used by the military, is now credited as part of the basis for Wi-Fi and Bluetooth. https://en.m.wikipedia.org/wiki/Hedy_Lamarr#Inventor https://en.m.wikipedia.org/wiki/Hedy_Lamarr#Inventor

by adekok 9y ago

ceejayoz 9y ago

Many of us don't have formal credentials in computer science or security. There are plenty of reasons to go after Equifax, but someone's college major from decades ago isn't one of them. https://www.washingtonpost.com/news/the-switch/wp/2017/09/19/equifaxs-top-security-exec-made-some-big-mistakes-studying-music-wasnt-one-of-them/ https://www.washingtonpost.com/news/the-switch/wp/2017/09/19...

v64 9y ago
I agree that having an unrelated background doesn't entirely disqualify a person from a position, but when the consequences of failure are high and more money is at stake, then selection should be much more stringent. She probably would be a great fit for that position at 99% of the companies in the country, but with Equifax's position and data, someone with a more extensive background in security would be preferable.
- ceejayoz 9y ago
  My understanding is her past roles included security work at HP, First Data, and Sun Trust. Equifax doesn't appear to have wandered into an orchestra practice and said "anyone wanna help run security?" Yeah, she fucked up. No, it wasn't because of her college major.
  - FilterSweep 9y ago
    I don't think it was the college major, true, but it appears she enjoyed a large scale of "falling up" into that position that most people in our industry aren't afforded.
    - ceejayoz 9y ago
      "It appears"? From what, her LinkedIn? What concrete information do we have to make that conclusion?
      - FilterSweep 9y ago
        The total mismanagement of customers and expectations after the hack. It would be naive to say the just the clear oversights in management were solely to blame - you can do everything right and still have data breaches. Far more intricate attacks could be perfected had the current vulnerabilities been resolved. You can argue "its a big company" all you want and that the responsibility shifted. However, at that position, setting up a shoddy website where customers can see if they were impacted, then request/pay for their own credit freeze, is NOT SUFFICIENT handling of the situation and betrays a long historied past of never having to had handle a situation so grave. Lives and livelihoods are at stake here. This isn't just a senior software engineer or technical director job where messups only breach trust. A crappy application developer could release buggy software, but one can "delete the app" at the end of the day. You can't uncork this bottle. This is a security position over some of the most personal data available on US citizens. If there is ANY belief that this person "fell up" through a security role, that needs to be identified.
  - v64 9y ago
    Her LinkedIn profile, before it was scrubbed, showed her as an employee of those companies, but her job title for each was listed as "Professional". It's not entirely clear what her previous roles were and exactly how relevant they were to the role of Chief Security Officer. It's the same divide between self taught developers and developers with a formal computer science background. If I'm hiring someone to make a website, then it may not make much of a difference, but if I need them to write kernel device drivers, more often than not your best bet is going to be with someone with a formal background who has had to demonstrate at school that they have certain knowledge prerequisites in a standardized setting. I can't speak for the cybersecurity at HP, Sun Trust, and First Data. It's possible they have great records, or it's possible they've made mistakes and gotten away with them, and these experiences led Mauldin to believe Equifax was more secure than it was. Edit: I found that she was Group VP at SunTrust from 07-09 and Senior VP and Chief Security Officer at First Data from 09-13. Her experience at First Data is relevant to the discussion and it's strange that the Washington Post article you linked to didn't mention that.
    - abiox 9y ago
      several people i've worked with graduated from respected CS programs yet could barely program their way out of wet paper bag. the best people (engineering-wise) i've worked with are people who had a passion for the subject, were generally inquisitive sorts, and engaged in a lot of self-directed learning and research because they simply wanted to... some had degrees, and some were high-school dropouts.
      - v64 9y ago
        > several people i've worked with graduated from respected CS programs yet could barely program their way out of wet paper bag How do you reconcile the fact that the individual could barely program, but they graduated from what you consider respected CS programs? Or are you saying that the programs have a public perception of respect that you personally don't believe they deserve? If the person passed that institution's examinations, then it seems to me that you're indicating either the institution has low standards compared to your industry or that they erroneously passed someone who did not meet their standards (either through incompetence or deception). I think it's relevant to note if the individuals graduated with a high GPA or if they barely scraped by. Of course autodidactism exists, but it can be very difficult to judge an individual's abilities based on one interview alone. A degree from a university at least indicates that the individual was exposed to the subject matter for a number of years, tested by individuals in the field who themselves have advanced credentials in the field, and passed the institution's examinations of knowledge. This isn't to say they're better qualified, but it gives you information that's more difficult for an individual to mislead you with. I can safely assume that a university has taken the expected precautions to ensure an individual's grades and credentials are reflective of their own work, as opposed to a self taught developer showing me a portfolio that may or may not be their original work entirely.
woranl 9y ago
I don't have formal credentials in medicine, but I know how to hold a knife. Will you trust me to do a surgery on you?
- deleted 9y ago
  [deleted]
- ceejayoz 9y ago
  There are plenty of doctors who majored in music.
  - woranl 9y ago
    Those doctors have formal credentials. Does Equifax security head have the equivalent formal credentials? Anyone can get to top position if they know who and how to suck up.
    - ceejayoz 9y ago
      What are these "equivalent" formal credentials for security?
- dredmorbius 9y ago
  Thirty years ago not only did modern computer security concepts not exist, and not only were there no programmes in them, but odds are good that "computer science" was part of the maths department. The first computer science department dates to 1962 at Purdue University (home of Eugene "Spaff" Spafford). Others formed generally during the 1970s and 1980s.
  - woranl 9y ago
    Last I checked, the leak was not thirty years ago.
    - dredmorbius 9y ago
      The degree was. And on-the-job experience is a thing. Your responses strongly suggest a failure to grant charitable consideration: Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

dahart 9y ago

FWIW, it's well known that high/surprising numbers of computer scientists have a music background. Some people think it's because the subjects are fundamentally similar. Do you know the story about the famous actress Hedy Lamarr, who invented a channel switching anti-jamming system for torpedos with a friend? Both were musicians with little or no experience, and their invention, aside from being patented and used by the military, is now credited as part of the basis for Wi-Fi and Bluetooth. https://en.m.wikipedia.org/wiki/Hedy_Lamarr#Inventor https://en.m.wikipedia.org/wiki/Hedy_Lamarr#Inventor