3 ms·

I'm not sure they knowingly ignored best practices, it's probably more that they were ignorant to them. I've personally meet with Chaos (chief security officer)

I'm not sure they knowingly ignored best practices, it's probably more that they were ignorant to them. I've personally meet with Chaos (chief security officer) from fortune 50 companies who didn't have a clue what ACLs are, how encryption works, or what an onion security model is. A lot of these people have been in the game long enough that many best practices we're invented after they stopped learning. This is does not justify their behavior, rather it provides more context around the a potential contributing cause.

nathantotten 9y ago
I would assume that a CSO at a F500 company is mostly responsible for things like budgeting, hiring, and high level strategy. I would think not knowing these specifics is reasonable. What isn’t excusable though is these companies ignoring advice from internal and external sources. Companies clearly make deliberate budget choices by weighing risk/reward and a CSO at a big company often rationally doesn’t make the right security choice because the risk is small. IMO, bills like this are needed in order to force companies to properly value the risk of bad security.
- alphonsegaston 9y ago
  The idea that you can make high-level strategy choices about security without intimate knowledge of that domain is what needs to go away. That kind of thinking is the product of a business culture designed to keeping rich people with MBAs employed over making sane decisions.
  - nathantotten 9y ago
    I think that's being a little extreme. I would guess that a CSO is typically somebody who has the experience, but has worked their way up. It is natural that as you progress in leadership in a company you become less knowledgeable about the details. A good executive is somebody who can hire the right people and listen to them. Somebody who has to know everything themselves is actually dangerous in my opinion - they are ignorant of what they don't know, could be unwilling to take advice, and may be inflexible about new ideas. To clarify, I am not talking about a CSO at a 100 person startup. I am talking about somebody like the CSO of equifax or Boeing which should have hundreds of people reporting to them. They cannot possible know the specifics of everything they secure.
mtgx 9y ago
More of a reason for data breach regulations to exist. If your CSO can't keep up, then he or she should be fired early.
acdha 9y ago
Try applying that reasoning to another field to see whether it still sounds like a reasonable excuse. I wouldn’t expect a CFO to be an expert on current tax laws in every place they go business but if they didn’t hire some experts and listen to them it’d be cause for firing and probably a personal lawsuit.
- bognition 9y ago
  It's not a reasonable excuse at all it's just the state things are in
  - acdha 9y ago
    My point was that by now not having experts on staff is knowingly ignoring best practice. They may have been able to get away with it but it’s still negligence which deserves no defense.
r00fus 9y ago
Does it matter if it's willful or not? 100s of millions of people's data was exposed due to negligence on the Equifax side. These people aren't Equifax's customers so can't "vote with their dollars". Having a C-level who knows nothing about the core practices of their domain should be treated as a liability for such an organization.

nathantotten 9y ago

I would assume that a CSO at a F500 company is mostly responsible for things like budgeting, hiring, and high level strategy. I would think not knowing these specifics is reasonable. What isn’t excusable though is these companies ignoring advice from internal and external sources. Companies clearly make deliberate budget choices by weighing risk/reward and a CSO at a big company often rationally doesn’t make the right security choice because the risk is small. IMO, bills like this are needed in order to force companies to properly value the risk of bad security.

alphonsegaston 9y ago
The idea that you can make high-level strategy choices about security without intimate knowledge of that domain is what needs to go away. That kind of thinking is the product of a business culture designed to keeping rich people with MBAs employed over making sane decisions.
- nathantotten 9y ago
  I think that's being a little extreme. I would guess that a CSO is typically somebody who has the experience, but has worked their way up. It is natural that as you progress in leadership in a company you become less knowledgeable about the details. A good executive is somebody who can hire the right people and listen to them. Somebody who has to know everything themselves is actually dangerous in my opinion - they are ignorant of what they don't know, could be unwilling to take advice, and may be inflexible about new ideas. To clarify, I am not talking about a CSO at a 100 person startup. I am talking about somebody like the CSO of equifax or Boeing which should have hundreds of people reporting to them. They cannot possible know the specifics of everything they secure.

mtgx 9y ago

More of a reason for data breach regulations to exist. If your CSO can't keep up, then he or she should be fired early.

acdha 9y ago

Try applying that reasoning to another field to see whether it still sounds like a reasonable excuse. I wouldn’t expect a CFO to be an expert on current tax laws in every place they go business but if they didn’t hire some experts and listen to them it’d be cause for firing and probably a personal lawsuit.

bognition 9y ago
It's not a reasonable excuse at all it's just the state things are in
- acdha 9y ago
  My point was that by now not having experts on staff is knowingly ignoring best practice. They may have been able to get away with it but it’s still negligence which deserves no defense.

r00fus 9y ago

Does it matter if it's willful or not? 100s of millions of people's data was exposed due to negligence on the Equifax side. These people aren't Equifax's customers so can't "vote with their dollars". Having a C-level who knows nothing about the core practices of their domain should be treated as a liability for such an organization.