5 ms·

I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear. No sensible person would sign up for the CSO position if th

I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear. No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against. There are millions of motivated adversaries out there and a finite number of employees at your company to outsmart them. It's a game you can't win. The larger your company becomes, the broader your attack surface becomes, and the higher value a target you become. You just have to hope that when you get hacked, it is a "forgiveable" hack like a zero-day or highly targeted attack. If CSO's are to be personally accountable for the malicious actions of others, it needs to be due to clear negligence on their part and the responsibilities need to be clearly defined.

bo1024 9y ago
You're in charge of security at a large e-commerce company, and your view is that your company is bound to get hacked? I think that's a very sad commentary on how little your company values security.
- randerson 9y ago
  Our company cares more about security than anyone in our space, if you look at how much we invest relative to the others. We have full time penetration testers on staff. We contract out to countless third party security vendors. We take their advice. This has nothing to do with not valuing security, it's just about being realistic. Can you guarantee that your company is hacker-proof? No? Then we're on the same page.
  - bo1024 9y ago
    I'm not sure why we have to accept a dichotomy between guaranteeing hacker-proofness and throwing up your hands and saying you're bound to get hacked no matter what you do. It's great that you take all those steps and investment. The fact that you still don't believe you can control whether or not you get hacked is a sad reflection of modern software practices, which are akin to throwing together a house out of plywood, newspaper, and gasoline, then asking the security team to place fire extinguishers.
    - Zenbit_UX 9y ago
      I don't think your metaphor applies here. I believe it's more like getting into a car accident. You can be the best driver in the world, you can always drive under the speed limit and take all precautions but you are bound to be in an accident at one point or another. You may go decades without incident but it's almost a certainty that you will find yourself in a situation where another driver collides with you in a way that couldn't have been forseen. This driver could have hit you accidentally or on purpose, it doesn't matter. You could be teaching another how to drive during the incident, you could have had a momentary lapse in judgment...it doesn't matter. What matters is how you handle the situation after the fact and the steps you took to mitigate the damage. If you spend enough time on the road the likelihood of an incident approaches 100%.
- FuckOffNeemo 9y ago
  I think your perspective is either immature or unrealistic. OP's a realistic. His perspective is nothing to do with how a company values security. No one in security assumes they won't get hacked, we assume we will and when we do get compromised. Our metrics aren't measured on if, our success metrics are: * How quickly we find out * How much damage we can mitigate * How quickly we mitigate the risks and controls for X vulnerability and * How we incorporate our reporting to find trends to find the event quicker next time Now we report on many compromises. I'm not talking just about data breaches here, there's a whole spectrum of compromises that we manage and mitigate. I don't know anyone who operates in Security who has a different mindset to OP.
  - bo1024 9y ago
    Having practices in case for the event of a hack is obviously good, but it doesn't imply believing that you can't control getting hacked and can't win against the hackers (previous poster's exact words).
    - deadmetheny 9y ago
      It's because you can't control it. There are limitless attackers and vectors. Security is mostly a game of being hardened enough to where most of those attackers will give up and go off looking for easier targets. Against a zero-day that nobody knows about yet, or an extremely determined attacker with a lot of patience? You will eventually lose, and you have to do your best to detect when it happens and act accordingly, as stated previously.
  - notyourday 9y ago
    > OP's a realistic. His perspective is nothing to do with how a company values security. Of course it does. The stick is not big enough so CSOs just do not care enough. Increase a size of the stick and it would split the group of CSOs into two: 1. Like OP will run away saying "I'm not going to put myself in a line of fire if crap gets hacked". We need broomsticks for those. 2. The ones that will say "OK, two years", do their best and probably succeed.
- Johnny555 9y ago
  More a sad commentary of how many people think there's some magic bullet of security practices and if they just follow those, then they won't be hacked. If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems. Otherwise, you'll be like a former coworker that refused to secure internal systems because "We paid a lot of money for our firewall, it's going to block any hackers". It took me less than 30 minutes on my first day to hack the login passwords of senior executives because they logged into a non-SSL reporting server (and I did through a simple MAC overflow attack on a network switch from a network port in the break room)
  - bo1024 9y ago
    > If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems. I see a big difference between preparing for the event of a hack, and believing that a hack is inevitable no matter what practices are in place.
    - Johnny555 9y ago
      How do you get your CEO to pay for the monitoring and other breach preparation if you've just told him that "We have air-tight security, we cannot get hacked"? CSO: We have airtight security, we cannot get hacked. CEO: Great! CSO: Please approve and fund this plan to handle a breach in case we are hacked. CEO: But you just told me we can't get hacked. CSO: Right, it's impossible. CEO: So why do we need to spend money preparing for it? CSO: Just in case. CEO: Just in case what? You just told me it can't happen. That seems a little like asking for money to prepare for an alien invasion or a zombie attack.
      - dboreham 9y ago
        Probably the CEO would have read the document their Insurance Carrier made him sign that details the measures they need to keep cyber cover valid and therefore this conversation wouldn't happen.
forapurpose 9y ago
You raise a difficult issue - how you would honestly resolve it. On one hand, CSOs cannot be personally liable for every hack. On the other, they shouldn't be given a pass on everything either. So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence? > A random engineer could make a mistake that gets hackers a step closer That could be prevented, to a large extent, with much tighter controls. Of course, those controls would greatly increases the cost of operations and other things. Is it possible we're all accustomed to the wrong model, that our standard of IT security is like the standard of car safety in the early auto industry (and maybe until the 1970s) - far too lenient? Maybe we should be facing the potential fact that the normal cost of IT should include those controls and other security expenses.
- nevir 9y ago
  > So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence? By analyzing how they prepared for the inevitable attack (mitigation), as well as how they respond to it after the fact.
  - qznc 9y ago
    (In the EU) companies are already required to tell where my personal data goes to. There is no specific fine for violations as far as I know though. Essentially we need a price tag on personal data. Let's say 1$ for each email and password leaked to an unknown number of entities. That would be a 114M$ incentive for Uber to keep their data secure.
    - zimpenfish 9y ago
      > There is no specific fine for violations as far as I know though. It's a shame this happened pre-GDPR because that has steep fines - 4% of worldwide revenue - which would be north of $260M going off their 2015 numbers. And that's assuming they get off with a single fine.
mlazos 9y ago
I’m not sure the previous comment is saying in all circumstances. I agree with what you’re saying - because higher officials obviously aren’t able to catch every mistake made by every engineer but I think the parent comment really meant that if there is gross negligence or intent to cover up breaches then that seems like a crime that the individual should be punished for.
harry8 9y ago
Not because you got hacked. No. Hell no. I never suggested that and reject it totally. We're talking about cover up, if you cover up the fact someone stole private data belonging to other people you took responsibility for. If you try and pretend it didn't happen because you might get away with it then claim you didn't know when it comes out? Then yes, absolutely, you deserve to risk jail time for that. As does your board of directors. CSOs, senior management, boards of directors should be personally responsible for their own actions. They need to have something at stake that they really dread losing when making the decision "perhaps we can get away with this?"
- jbob2000 9y ago
  The problem with jail time is that the courts need to assess how much damage was done to determine what a fair sentence is. How do you assess the damage done during a data leak? Do you get one hour of jail time for each person's data you leaked? Do you get a day per gigabyte leaked? What if nobody does anything with the stolen data? And how do you make that scale? If I miss a semicolon and leak 5 people's data, then I'd hardly get any jail time. If I miss a semicolon and leak 150,000,000 people's data, I will die in prison. In both scenarios, I made the same error, but the outcomes were insanely different!
  - Atheros 9y ago
    The law as plenty of experience dealing with sufficient nuance to distinguish a mistake from negligence.
- dboreham 9y ago
  Covering up isn't done by the CSO. It'll be driven by lawyers, or worst-case by a rogue CEO. Mind you the CSO would be expected to resign under those circumstances, if they were kept in the loop on the cover up plan.
- whack 9y ago
  IANAL but isn't it already the case that if you knowingly break a law, you can be convicted and sentenced to jail? In this case, I'm assuming that it's not against the law to cover up a hacking incident, in which case there's no basis to suggest putting someone in jail.
djellybeans 9y ago
It's not really much about that Uber got hacked, which is bad enough. It's that they paid off the hackers and didn't tell anyone they got hacked until now.
hvidgaard 9y ago
If you can demonstrate due process and reasonable effort to secure against breaches, your doing your job. For instance with described procedures, sane defaults, locked down environments ect. But if you're a CSO and have not described threatmodels, workflows, and security practices, then you've not done your job and should be held accountable for data breaches.

bo1024 9y ago

You're in charge of security at a large e-commerce company, and your view is that your company is bound to get hacked? I think that's a very sad commentary on how little your company values security.

randerson 9y ago
Our company cares more about security than anyone in our space, if you look at how much we invest relative to the others. We have full time penetration testers on staff. We contract out to countless third party security vendors. We take their advice. This has nothing to do with not valuing security, it's just about being realistic. Can you guarantee that your company is hacker-proof? No? Then we're on the same page.
- bo1024 9y ago
  I'm not sure why we have to accept a dichotomy between guaranteeing hacker-proofness and throwing up your hands and saying you're bound to get hacked no matter what you do. It's great that you take all those steps and investment. The fact that you still don't believe you can control whether or not you get hacked is a sad reflection of modern software practices, which are akin to throwing together a house out of plywood, newspaper, and gasoline, then asking the security team to place fire extinguishers.
  - Zenbit_UX 9y ago
    I don't think your metaphor applies here. I believe it's more like getting into a car accident. You can be the best driver in the world, you can always drive under the speed limit and take all precautions but you are bound to be in an accident at one point or another. You may go decades without incident but it's almost a certainty that you will find yourself in a situation where another driver collides with you in a way that couldn't have been forseen. This driver could have hit you accidentally or on purpose, it doesn't matter. You could be teaching another how to drive during the incident, you could have had a momentary lapse in judgment...it doesn't matter. What matters is how you handle the situation after the fact and the steps you took to mitigate the damage. If you spend enough time on the road the likelihood of an incident approaches 100%.
FuckOffNeemo 9y ago
I think your perspective is either immature or unrealistic. OP's a realistic. His perspective is nothing to do with how a company values security. No one in security assumes they won't get hacked, we assume we will and when we do get compromised. Our metrics aren't measured on if, our success metrics are: * How quickly we find out * How much damage we can mitigate * How quickly we mitigate the risks and controls for X vulnerability and * How we incorporate our reporting to find trends to find the event quicker next time Now we report on many compromises. I'm not talking just about data breaches here, there's a whole spectrum of compromises that we manage and mitigate. I don't know anyone who operates in Security who has a different mindset to OP.
- bo1024 9y ago
  Having practices in case for the event of a hack is obviously good, but it doesn't imply believing that you can't control getting hacked and can't win against the hackers (previous poster's exact words).
  - deadmetheny 9y ago
    It's because you can't control it. There are limitless attackers and vectors. Security is mostly a game of being hardened enough to where most of those attackers will give up and go off looking for easier targets. Against a zero-day that nobody knows about yet, or an extremely determined attacker with a lot of patience? You will eventually lose, and you have to do your best to detect when it happens and act accordingly, as stated previously.
- notyourday 9y ago
  > OP's a realistic. His perspective is nothing to do with how a company values security. Of course it does. The stick is not big enough so CSOs just do not care enough. Increase a size of the stick and it would split the group of CSOs into two: 1. Like OP will run away saying "I'm not going to put myself in a line of fire if crap gets hacked". We need broomsticks for those. 2. The ones that will say "OK, two years", do their best and probably succeed.
Johnny555 9y ago
More a sad commentary of how many people think there's some magic bullet of security practices and if they just follow those, then they won't be hacked. If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems. Otherwise, you'll be like a former coworker that refused to secure internal systems because "We paid a lot of money for our firewall, it's going to block any hackers". It took me less than 30 minutes on my first day to hack the login passwords of senior executives because they logged into a non-SSL reporting server (and I did through a simple MAC overflow attack on a network switch from a network port in the break room)
- bo1024 9y ago
  > If you don't assume that you will be hacked, then you won't design in auditing, alerting and containment that will tell you when you've been hacked, let you determine what data was compromised, and prevent the attacker from having free reign over all of your systems. I see a big difference between preparing for the event of a hack, and believing that a hack is inevitable no matter what practices are in place.
  - Johnny555 9y ago
    How do you get your CEO to pay for the monitoring and other breach preparation if you've just told him that "We have air-tight security, we cannot get hacked"? CSO: We have airtight security, we cannot get hacked. CEO: Great! CSO: Please approve and fund this plan to handle a breach in case we are hacked. CEO: But you just told me we can't get hacked. CSO: Right, it's impossible. CEO: So why do we need to spend money preparing for it? CSO: Just in case. CEO: Just in case what? You just told me it can't happen. That seems a little like asking for money to prepare for an alien invasion or a zombie attack.
    - dboreham 9y ago
      Probably the CEO would have read the document their Insurance Carrier made him sign that details the measures they need to keep cyber cover valid and therefore this conversation wouldn't happen.

forapurpose 9y ago

You raise a difficult issue - how you would honestly resolve it. On one hand, CSOs cannot be personally liable for every hack. On the other, they shouldn't be given a pass on everything either. So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence? > A random engineer could make a mistake that gets hackers a step closer That could be prevented, to a large extent, with much tighter controls. Of course, those controls would greatly increases the cost of operations and other things. Is it possible we're all accustomed to the wrong model, that our standard of IT security is like the standard of car safety in the early auto industry (and maybe until the 1970s) - far too lenient? Maybe we should be facing the potential fact that the normal cost of IT should include those controls and other security expenses.

nevir 9y ago
> So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence? By analyzing how they prepared for the inevitable attack (mitigation), as well as how they respond to it after the fact.
- qznc 9y ago
  (In the EU) companies are already required to tell where my personal data goes to. There is no specific fine for violations as far as I know though. Essentially we need a price tag on personal data. Let's say 1$ for each email and password leaked to an unknown number of entities. That would be a 114M$ incentive for Uber to keep their data secure.
  - zimpenfish 9y ago
    > There is no specific fine for violations as far as I know though. It's a shame this happened pre-GDPR because that has steep fines - 4% of worldwide revenue - which would be north of $260M going off their 2015 numbers. And that's assuming they get off with a single fine.

mlazos 9y ago

I’m not sure the previous comment is saying in all circumstances. I agree with what you’re saying - because higher officials obviously aren’t able to catch every mistake made by every engineer but I think the parent comment really meant that if there is gross negligence or intent to cover up breaches then that seems like a crime that the individual should be punished for.

harry8 9y ago

Not because you got hacked. No. Hell no. I never suggested that and reject it totally. We're talking about cover up, if you cover up the fact someone stole private data belonging to other people you took responsibility for. If you try and pretend it didn't happen because you might get away with it then claim you didn't know when it comes out? Then yes, absolutely, you deserve to risk jail time for that. As does your board of directors. CSOs, senior management, boards of directors should be personally responsible for their own actions. They need to have something at stake that they really dread losing when making the decision "perhaps we can get away with this?"

jbob2000 9y ago
The problem with jail time is that the courts need to assess how much damage was done to determine what a fair sentence is. How do you assess the damage done during a data leak? Do you get one hour of jail time for each person's data you leaked? Do you get a day per gigabyte leaked? What if nobody does anything with the stolen data? And how do you make that scale? If I miss a semicolon and leak 5 people's data, then I'd hardly get any jail time. If I miss a semicolon and leak 150,000,000 people's data, I will die in prison. In both scenarios, I made the same error, but the outcomes were insanely different!
- Atheros 9y ago
  The law as plenty of experience dealing with sufficient nuance to distinguish a mistake from negligence.
dboreham 9y ago
Covering up isn't done by the CSO. It'll be driven by lawyers, or worst-case by a rogue CEO. Mind you the CSO would be expected to resign under those circumstances, if they were kept in the loop on the cover up plan.
whack 9y ago
IANAL but isn't it already the case that if you knowingly break a law, you can be convicted and sentenced to jail? In this case, I'm assuming that it's not against the law to cover up a hacking incident, in which case there's no basis to suggest putting someone in jail.

djellybeans 9y ago

It's not really much about that Uber got hacked, which is bad enough. It's that they paid off the hackers and didn't tell anyone they got hacked until now.

hvidgaard 9y ago

If you can demonstrate due process and reasonable effort to secure against breaches, your doing your job. For instance with described procedures, sane defaults, locked down environments ect. But if you're a CSO and have not described threatmodels, workflows, and security practices, then you've not done your job and should be held accountable for data breaches.