3 ms·

> no one lost his or her job Eh? Both the CSO and CIO lost their jobs over this. They "retired", but that's simply a nice way of saying they were fired. > no

> no one lost his or her job Eh? Both the CSO and CIO lost their jobs over this. They "retired", but that's simply a nice way of saying they were fired. > no one went to jail I struggle to see why anyone in this situation should be in jail. They did nothing illegal. At worst, as this report shows, they were woefully incompetent. If there was a person who had maliciously caused deficiencies in their security or knowingly disobeyed relevant regulations, that might be worthy of jailtime. But the moment we start putting people in jail just because they're bad at their jobs... we'd have to imprison half of the country. This is actually a huge issue with the security industry right now. It is very difficult to find qualified people to fill CISO roles because the general consensus is that their company will be hacked (either from a 0-day or from a long-lasting, hard-to-kill vulnerability that has been present since long before the new CISO arrived), and the CISO will be blamed. As it is, most qualified security practitioners would much rather choose a consulting position where they don't have to worry about being blamed. Now imagine how worse that situation would be if you started threatening every CISO who got hacked not just with being fired and publicly shamed, but with jailtime, too.

rectang 7y ago
It should be hard to fill CISO roles because most companies collect an excess of toxic PII data. Over time, perhaps more companies will learn how to avoid aggregating such data, and gravitate towards business models with smaller liability exposure.
- txcwpalpha 7y ago
  PII or not, companies are still going to be hacked. PII isn't even amongst the most valuable types of data that attackers are after, nor is it the most damaging type of data for a company to lose. It should be hard to fill CISO roles because companies should have high standards and should be looking for the best of the best to fill those roles. But that's not what I'm talking about. There is a decent sized pool of qualified security practitioners that could be CISOs, but none of them want to be because the current way things work is that they will inevitably get fired and shamed for something that they had little control over. That's not good for them, and it's not good for us, because you know what's worse than a company having a lot of insecure PII? A company that has a lot of insecure PII that also doesn't have a CISO.
manquer 7y ago
They need to face consequence of their in-actions not because they got hacked. If you did follow good practices and still got hacked by an zero day it is one thing and your point is valid, however when you hacked because of gross negligence and effectively kept your doors open it is something else and that should be punished ?
catacombs 7y ago
> Eh? Both the CSO and CIO lost their jobs over this. They "retired", but that's simply a nice way of saying they were fired. "Retired" means leaving the company with a golden parachute and laughing their way to the bank.

rectang 7y ago

It should be hard to fill CISO roles because most companies collect an excess of toxic PII data. Over time, perhaps more companies will learn how to avoid aggregating such data, and gravitate towards business models with smaller liability exposure.

txcwpalpha 7y ago
PII or not, companies are still going to be hacked. PII isn't even amongst the most valuable types of data that attackers are after, nor is it the most damaging type of data for a company to lose. It should be hard to fill CISO roles because companies should have high standards and should be looking for the best of the best to fill those roles. But that's not what I'm talking about. There is a decent sized pool of qualified security practitioners that could be CISOs, but none of them want to be because the current way things work is that they will inevitably get fired and shamed for something that they had little control over. That's not good for them, and it's not good for us, because you know what's worse than a company having a lot of insecure PII? A company that has a lot of insecure PII that also doesn't have a CISO.

manquer 7y ago

They need to face consequence of their in-actions not because they got hacked. If you did follow good practices and still got hacked by an zero day it is one thing and your point is valid, however when you hacked because of gross negligence and effectively kept your doors open it is something else and that should be punished ?

catacombs 7y ago

> Eh? Both the CSO and CIO lost their jobs over this. They "retired", but that's simply a nice way of saying they were fired. "Retired" means leaving the company with a golden parachute and laughing their way to the bank.