3 ms·

From the article it looked like he told the truth about the attacks at Yahoo and Marissa lied. I’d leave too under those conditions. Nice knowing that the SEC

• m0zg 8y ago
  As a CISO it was his responsibility to never end up in that situation in the first place.
  • throwawaymath 8y ago
    This is a very naive view of information security. The most sophisticated approaches to modern security - either in technical app/net sec or in risk management - begin from the assumption that vulnerabilities exist and will be exploited. Every security team should be proactively trying to eliminate security vulnerabilities. But they will happen nonetheless, and the mark of truly secure organizations is in the way they respond to such vulnerabilities. At the CISO level this becomes even more important: a CISO is not only responsible for setting the organizational mandates for security. They are also responsible for being the public face which responds to notable security events.
    • m0zg 8y ago
      Well, neither Yahoo's nor FB's security teams have eliminated the gaping security holes in question, from which I conclude that maybe he just isn't as good as his "public face" would imply.
      • kerng 8y ago
        I wouldn't hire a CISO associated with multiple large breaches in the past as CISO for my company... I think there would be better options.
        • m0zg 8y ago
          And neither would I, but a lot of people here apparently would, if his "public face" is pretty enough.
  • jedberg 8y ago
    That is only true if management follows your recommendations. If they decide profit is more important than security, than your job is to mitigate as much risk as possible and detect breaches as quickly as possible. Which he did.
    • lawnchair_larry 8y ago
      Your most important job is to come up with recommendations that are tenable for the business and to sell the business on them. It’s not easy, but that is the job. Shouting that other people are idiots because you told them to unplug the internet and then blaming them for ignoring you demonstrates a lack of maturity required at that level.
  • qznc 8y ago
    From what I have heard from a CISO, they often get the job but not the power or budget. That turns then into a scapegoat if things go wrong. The day job is primarily politics to get some meager resources for security from somewhere and raising awareness.