3 ms·

> The Equifax breach here was caused by, at the very least, reckless negligence in that they failed to patch a published vulnerability for MONTHS after it was d

by adekok 9y ago

> The Equifax breach here was caused by, at the very least, reckless negligence in that they failed to patch a published vulnerability for MONTHS after it was disclosed Managed by a security VP who had no relevant experience? I posted this in another comment, and got massively downvoted. Not sure why...

gamad 9y ago
Because you can't criticize "women" in "IT".
abritinthebay 9y ago
I actually haven't seen their experience posted anywhere. I have seen their degree, but that's meaningless as most of the truly talented developers and technical people I know have a degree that is not directly specific to their current role. What was their experience before Equifax? Do you have links?
- adekok 9y ago
  http://www.marketwatch.com/story/equifax-ceo-hired-a-music-major-as-the-companys-chief-security-officer-2017-09-15 http://www.marketwatch.com/story/equifax-ceo-hired-a-music-m... Equifax “Chief Security Officer” Susan Mauldin has a bachelor’s degree and a master of fine arts degree in music composition from the University of Georgia. Her LinkedIn professional profile lists no education related to technology or security. Her LinkedIn profile has since been removed entirely. A copy is shown here: https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic... She was previously Senior Vice President and Chief Security Officer at First Data Corporation, until July 2013. The snippet posted there shows her previous jobs as "professional". No security person I know has zero security experience on their resume.
  - abiox 9y ago
    it's not like a c-level at a large corp is personally handling technical implementation details. outside of a small startup, an exec is not a 'security person' in the sense you say. it's one thing to say it happened on mauldin's watch and as the senior person in charge of security they bear responsibility (as any leader does). this degree stuff, however, is mostly security theater and very weak argumentation.
    - adekok 9y ago
      The point is nothing in her resume shows she has any experience in the field. While I don't expect an exec to be at the same level as current researchers, they should know something about the field. Her music degree is not completely relevant, tho it is concerning. The rest of her resume (and total lack of relevant experience) is more damning. Look, I personally know someone who's a C level in a tech company, with a political science degree. But his resume shows 15 years of full-time employment in his current field, plus summer jobs in university, and going back to high school. So with 20 years of experience in the field, his degree doesn't matter so much. Your counter position seems to say that execs can manage a division while knowing nothing about what the division does. There's just no way that's true. The exec must know something in order to be able to prioritize projects, set goals, mediate disagreements, etc. Or would you say that someone who has no education in a field, and no experience in a field, is qualified to be an executive-level manager for that field? That's just hard to believe.
      - ericd 9y ago
        The idea that a management specialist can effectively lead divisions and companies in fields that they have no concrete experience in is a popular one in MBA circles (very conveniently, because it means MBAs have many more opportunities). It's also a crock.
      - goialoq 9y ago
        https://www.washingtonpost.com/news/the-switch/wp/2017/09/19/equifaxs-top-security-exec-made-some-big-mistakes-studying-music-wasnt-one-of-them/ https://www.washingtonpost.com/news/the-switch/wp/2017/09/19... Alice Goldfuss @alicegoldfuss Hi, I'm a Site Reliability Engineer at a large tech company. I have a BFA in Film. Steaknap Sleepchew @treelzebub Android Tech Lead here. Was a Religious Studies major, then a cook/chef for 12 years. #unqualifiedfortech Richard Bejtlich @taosecurity Undergrad degrees in history, pol sci, French, German. Masters in public policy. Wrote 4 #cybersecurity books, was CISO. #unqualifiedfortech Twitter Ads info and privacy (Bejtlich is the former chief information security officer at Mandiant, a cyber forensics firm that has investigated data breaches at many companies, including Equifax.) Joe Uchill @JoeUchill Peter Thiel majored in 20th centrury philosophy. Now he harvests the blood of the young.#unqualifiedfortech About 85 percent of Duo Security's hires do not have a formal background in information security, Wendy Nather @wendynather I don't have a degree; if I'd gotten one, it would have been in liberal arts. But I've been in tech for 30 years, so their logic is flawed. https://twitter.com/alicegoldfuss/status/908430394529259520 https://twitter.com/alicegoldfuss/status/908430394529259520 … Follow Derek Robson @asinine_net_nz I know several people in infosec wth a music degree. And a CISO is as much about risk management as CS and tech.
  - abritinthebay 9y ago
    That LinkedIn profile doesn't support your argument other than she's worked at some very high profile companies as a "Professional" for ~15 years. If you have more insight, please do share, but there is none in those links. So basically you're posting about the degree nonsense and non-story.
    - adekok 9y ago
      > That LinkedIn profile doesn't support Any argument. So far as any evidence goes, she has zero experience in the field. So basically you're trying to nit-pick at me for saying that there's no evidence she has any experience... while not showing any evidence that she has experience.
      - abritinthebay 9y ago
        > So far as any evidence goes, she has zero experience in the field. Er.. no. As far as evidence goes there is not enough evidence to draw a conclusion. Saying she has zero experience is not the default - it's a position. So basically, again, I ask for any evidence of the original statement. So far there has been none (this might be why there were downvotes before btw).
        adekok 9y ago
        Again: nothing in her resume shows she has any experience in the field. It is entirely reasonable, therefore, to suggest she has no relevant experience. Likewise, it is entirely reasonable to suggest she might have some relevant experience, but is unwilling to state more than "Professional" on her resume.
        abritinthebay 9y ago
        In response I will be nice and just say: You would fare very poorly in a high-school debate forum.
jstarfish 9y ago
Because you're trying to instigate a credentialist witch hunt. It's a business role, not a technical one. You don't need to be an accountant to be CFO either. You just need to make domain-specific business decisions that keep the CEO in power and be the public face of failure in his stead. The internal culture there is such that revenue is prioritized over responsibility. Said culture is driven from the top. EFX stock had been rising steadily for years under Smith's direction, and we're now seeing at what cost. Concern yourself all you want with the CISO's music degrees. I'm just glad to see the person actually responsible for this toxic culture has finally taken the knife.

by adekok 9y ago

gamad 9y ago

Because you can't criticize "women" in "IT".

abritinthebay 9y ago

I actually haven't seen their experience posted anywhere. I have seen their degree, but that's meaningless as most of the truly talented developers and technical people I know have a degree that is not directly specific to their current role. What was their experience before Equifax? Do you have links?

adekok 9y ago
http://www.marketwatch.com/story/equifax-ceo-hired-a-music-major-as-the-companys-chief-security-officer-2017-09-15 http://www.marketwatch.com/story/equifax-ceo-hired-a-music-m... Equifax “Chief Security Officer” Susan Mauldin has a bachelor’s degree and a master of fine arts degree in music composition from the University of Georgia. Her LinkedIn professional profile lists no education related to technology or security. Her LinkedIn profile has since been removed entirely. A copy is shown here: https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic... She was previously Senior Vice President and Chief Security Officer at First Data Corporation, until July 2013. The snippet posted there shows her previous jobs as "professional". No security person I know has zero security experience on their resume.
- abiox 9y ago
  it's not like a c-level at a large corp is personally handling technical implementation details. outside of a small startup, an exec is not a 'security person' in the sense you say. it's one thing to say it happened on mauldin's watch and as the senior person in charge of security they bear responsibility (as any leader does). this degree stuff, however, is mostly security theater and very weak argumentation.
  - adekok 9y ago
    The point is nothing in her resume shows she has any experience in the field. While I don't expect an exec to be at the same level as current researchers, they should know something about the field. Her music degree is not completely relevant, tho it is concerning. The rest of her resume (and total lack of relevant experience) is more damning. Look, I personally know someone who's a C level in a tech company, with a political science degree. But his resume shows 15 years of full-time employment in his current field, plus summer jobs in university, and going back to high school. So with 20 years of experience in the field, his degree doesn't matter so much. Your counter position seems to say that execs can manage a division while knowing nothing about what the division does. There's just no way that's true. The exec must know something in order to be able to prioritize projects, set goals, mediate disagreements, etc. Or would you say that someone who has no education in a field, and no experience in a field, is qualified to be an executive-level manager for that field? That's just hard to believe.
    - ericd 9y ago
      The idea that a management specialist can effectively lead divisions and companies in fields that they have no concrete experience in is a popular one in MBA circles (very conveniently, because it means MBAs have many more opportunities). It's also a crock.
    - goialoq 9y ago
      https://www.washingtonpost.com/news/the-switch/wp/2017/09/19/equifaxs-top-security-exec-made-some-big-mistakes-studying-music-wasnt-one-of-them/ https://www.washingtonpost.com/news/the-switch/wp/2017/09/19... Alice Goldfuss @alicegoldfuss Hi, I'm a Site Reliability Engineer at a large tech company. I have a BFA in Film. Steaknap Sleepchew @treelzebub Android Tech Lead here. Was a Religious Studies major, then a cook/chef for 12 years. #unqualifiedfortech Richard Bejtlich @taosecurity Undergrad degrees in history, pol sci, French, German. Masters in public policy. Wrote 4 #cybersecurity books, was CISO. #unqualifiedfortech Twitter Ads info and privacy (Bejtlich is the former chief information security officer at Mandiant, a cyber forensics firm that has investigated data breaches at many companies, including Equifax.) Joe Uchill @JoeUchill Peter Thiel majored in 20th centrury philosophy. Now he harvests the blood of the young.#unqualifiedfortech About 85 percent of Duo Security's hires do not have a formal background in information security, Wendy Nather @wendynather I don't have a degree; if I'd gotten one, it would have been in liberal arts. But I've been in tech for 30 years, so their logic is flawed. https://twitter.com/alicegoldfuss/status/908430394529259520 https://twitter.com/alicegoldfuss/status/908430394529259520 … Follow Derek Robson @asinine_net_nz I know several people in infosec wth a music degree. And a CISO is as much about risk management as CS and tech.
- abritinthebay 9y ago
  That LinkedIn profile doesn't support your argument other than she's worked at some very high profile companies as a "Professional" for ~15 years. If you have more insight, please do share, but there is none in those links. So basically you're posting about the degree nonsense and non-story.
  - adekok 9y ago
    > That LinkedIn profile doesn't support Any argument. So far as any evidence goes, she has zero experience in the field. So basically you're trying to nit-pick at me for saying that there's no evidence she has any experience... while not showing any evidence that she has experience.
    - abritinthebay 9y ago
      > So far as any evidence goes, she has zero experience in the field. Er.. no. As far as evidence goes there is not enough evidence to draw a conclusion. Saying she has zero experience is not the default - it's a position. So basically, again, I ask for any evidence of the original statement. So far there has been none (this might be why there were downvotes before btw).
      - adekok 9y ago
        Again: nothing in her resume shows she has any experience in the field. It is entirely reasonable, therefore, to suggest she has no relevant experience. Likewise, it is entirely reasonable to suggest she might have some relevant experience, but is unwilling to state more than "Professional" on her resume.
        abritinthebay 9y ago
        In response I will be nice and just say: You would fare very poorly in a high-school debate forum.

jstarfish 9y ago

Because you're trying to instigate a credentialist witch hunt. It's a business role, not a technical one. You don't need to be an accountant to be CFO either. You just need to make domain-specific business decisions that keep the CEO in power and be the public face of failure in his stead. The internal culture there is such that revenue is prioritized over responsibility. Said culture is driven from the top. EFX stock had been rising steadily for years under Smith's direction, and we're now seeing at what cost. Concern yourself all you want with the CISO's music degrees. I'm just glad to see the person actually responsible for this toxic culture has finally taken the knife.