5 ms·

Alex Stamos is an interesting CISO both Yahoo and Facebook had giant breaches under his tenure and he leaves pretty much right after.

• m0zg 8y ago
  "Success consists of going from failure to failure without loss of enthusiasm." -- Winston Churchill
  • sexyrouter 8y ago
    I hope people stop quoting such an awful man responsible for genocide in South Asia. It's a very painful memory for some everytime his name comes up.
    • deleted 8y ago
      [deleted]
  • thatcat 8y ago
    Sounds like what some one would do if they got a golden parachute from every failure.
• MR4D 8y ago
  From the article it looked like he told the truth about the attacks at Yahoo and Marissa lied. I’d leave too under those conditions. Nice knowing that the SEC investigation backs up his story.
  • m0zg 8y ago
    As a CISO it was his responsibility to never end up in that situation in the first place.
    • throwawaymath 8y ago
      This is a very naive view of information security. The most sophisticated approaches to modern security - either in technical app/net sec or in risk management - begin from the assumption that vulnerabilities exist and will be exploited. Every security team should be proactively trying to eliminate security vulnerabilities. But they will happen nonetheless, and the mark of truly secure organizations is in the way they respond to such vulnerabilities. At the CISO level this becomes even more important: a CISO is not only responsible for setting the organizational mandates for security. They are also responsible for being the public face which responds to notable security events.
      • m0zg 8y ago
        Well, neither Yahoo's nor FB's security teams have eliminated the gaping security holes in question, from which I conclude that maybe he just isn't as good as his "public face" would imply.
        • kerng 8y ago
          I wouldn't hire a CISO associated with multiple large breaches in the past as CISO for my company... I think there would be better options.
          • m0zg 8y ago
            And neither would I, but a lot of people here apparently would, if his "public face" is pretty enough.
    • jedberg 8y ago
      That is only true if management follows your recommendations. If they decide profit is more important than security, than your job is to mitigate as much risk as possible and detect breaches as quickly as possible. Which he did.
      • lawnchair_larry 8y ago
        Your most important job is to come up with recommendations that are tenable for the business and to sell the business on them. It’s not easy, but that is the job. Shouting that other people are idiots because you told them to unplug the internet and then blaming them for ignoring you demonstrates a lack of maturity required at that level.
    • qznc 8y ago
      From what I have heard from a CISO, they often get the job but not the power or budget. That turns then into a scapegoat if things go wrong. The day job is primarily politics to get some meager resources for security from somewhere and raising awareness.
• jedberg 8y ago
  According to the article, that's because in both cases they asked him to help in the cover up, and he refused to bend his ethics like that.
  • lawnchair_larry 8y ago
    But also according to the article, he’s not a very effective manager and difficult to work both for and with. That’s consistent with what I’ve heard in security circles outside of his infosec microcelebrity friends. You do need exceptional people and political skills to be effective in these jobs, and arrogance is a really bad attribute if your job is to influence.
• nelsonic 8y ago
  A CISO's task is thankless. Beyond financial compensation, which is comparatively lower than the "rock star developers" or executives, the CISO does not get thanked for making the product(s) more secure, ensuring security tends to add more dev time and QA steps which makes everyone working on the product feel like things are taking longer. The CISO is fighting against the mindset of all other managers in the company who just want to "deliver" the features to make their numbers for the quarter (so they can get a bonus or be promoted), and the developers who are required to "cut corners" both in terms of quality and security in order to ship. Both Yahoo and Facebook have a history of insecurity that dates back far before the arrival of Alex Stamos, who as others have said, is the "fall guy" when the leaders of the organisation prioritise short-term profits/growth over the security of user's data.
  • lawnchair_larry 8y ago
    The compensation for these roles is VP+ level, way more than rockstar developers.
    • chillee 8y ago
      There's a lot that's uneviable about Stamos's position - his compensation is not one of them.
• trumped 8y ago
  It doesn't take way from the fact that he is right...