5 ms·

https://www.linkedin.com/in/michael-johnson-098437117/ https://www.linkedin.com/in/michael-johnson-098437117/ They hired a bureaucrat, not an engineer, to be t

by ummonk 7y ago

https://www.linkedin.com/in/michael-johnson-098437117/ https://www.linkedin.com/in/michael-johnson-098437117/ They hired a bureaucrat, not an engineer, to be their CISO.

hanniabu 7y ago
Sounds like they hired an Olympian
rficcaglia 7y ago
He worked at Sandia so he seems to have engineering chops. But it is ridiculous to think that one individual or even one isolated group can defend against pervasive threats. Like worker safety, it has to be a cultural priority starting at the top and made priority #1 in every decision and work process. Even then, security is an illusion. Eventually something or someone will find a way to get through. Zero trust needs to be embraced. Assume every employee, partner, developer and vendor is going to have full internal access and abuse it...then defend from there.
txcwpalpha 7y ago
Hiring an engineer (and by that I assume you mean someone who has the bulk of their experience as a software engineer) as CISO is exactly the opposite of what a company should do. Security is absolutely not the same skill set as software engineering, and it's a huge misconception that people equate infosec with programming. Security engineers of course should be programmers, but an enormous amount of work that goes into infosec has absolutely nothing to do with code, and this is especially true for someone high up in management ranks like a CISO where their entire job is dealing with bureaucracy. Hiring an engineer to be a CISO would be like choosing a biologist to give you surgery instead of a surgeon. Yes, a biologist probably knows a lot about the nitty-gritty of how bodies work, but knowing how the body works and knowing how to perform surgery on a body are two very, very different things. That guy's LinkedIn looks more than qualified to be a CISO, and is certainly more qualified than the vast majority of CISOs I worked with in my career as a security consultant. And on top of all that, he has a degree in computer engineering and has prior experience as an engineer, so I have no idea why you're claiming he isn't an engineer.
- goatinaboat 7y ago
  I see where you’re coming from but this is not far off the thinking that “an MBA can manage anything”. To use your analogy no surgeon is allowed to cut until he or she does have a solid grounding in biology.
  - txcwpalpha 7y ago
    You're right, that wasn't a very good analogy. My point is not to say that a CISO/surgeon shouldn't have any experience in engineering/biology (in fact, as you pointed out, it is the opposite! you ideally want a CISO with some technical chops just as you want a surgeon with some biology knowledge). My point is that there is much more to being a CISO than just technical knowledge. Maybe a better analogy would be choosing someone to represent you in a lawsuit about programming patents. You would want a lawyer representing you, not a programmer. Ideally the lawyer would have some previous experience with these kinds of cases and would lean on programming experts for their knowledge. Maybe they are even a former programmer turned lawyer! But I certainly wouldn't hire "a programmer" to represent me no matter how experienced in programming they are. Linus Torvalds would be a great expert witness, but he isn't going to be my general counsel.
    - mieseratte 7y ago
      I would say the lawsuit example isn't great, lawyer is a specialized profession unto itself. Management has it's own vagaries, but I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering and that was the original point. Having someone with no background in engineering running a department is suspect.
      - txcwpalpha 7y ago
        There's still a disconnect here. Infosec is a specialized profession unto itself, too. A CISO is not just "an engineer that's gone into management". My original point is that security is so far removed from "engineering" that it's incorrect to equate the two (even though it's done all the time). >I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering IME, it's the opposite. It depends on your specific goal (are we trying to train someone to be CISO or are we training them to be a SOC team leader?), but it's ridiculously easier (and more effective) to take a person with existing management abilities and teach them about security than it is to take an engineer and teach them security management skills. >Having someone with no background in engineering running a department is suspect. It's really not, because again, engineering != security. It's no more suspect than the CFO not having a background in engineering.
goatinaboat 7y ago
Wasn’t that the same at Equifax? https://www.marketwatch.com/story/equifax-ceo-hired-a-music-major-as-the-companys-chief-security-officer-2017-09-15 https://www.marketwatch.com/story/equifax-ceo-hired-a-music-...
ttul 7y ago
This is an extreme manipulation of the facts. He has an M.Sc in Computer Science, did R&D at Hewlett-Packard during their golden age, and then spent 22 years at Sandia. This guy was only a bureaucrat in the thinnest interpretation of the word.
raghava 7y ago
What according to you is a qualification to be a CISO, of a bank or a financial institution? I would any day put my money in a bank who has a CISO with such credentials as that of Michael Johnson. He has been an engineer, done R&D, does have the right chops too I guess. And CyberSec has multiple layers - mostly the people, which is the weakest one. And that, my friend, cannot really be solved just by tech.
ilaksh 7y ago
Whatever he was, if the article is to be believed, it seems like his poor management caused the problem. I believe it. This is often the case, where managers actively interfere with priorities that the engineers try to provide. Not only that but he was using resources to play politics. The issue is that fundamentally that's what managers and executives do. Their profession is politicking and manipulation rather than solving problems.

by ummonk 7y ago

https://www.linkedin.com/in/michael-johnson-098437117/ https://www.linkedin.com/in/michael-johnson-098437117/ They hired a bureaucrat, not an engineer, to be their CISO.

hanniabu 7y ago

Sounds like they hired an Olympian

rficcaglia 7y ago

He worked at Sandia so he seems to have engineering chops. But it is ridiculous to think that one individual or even one isolated group can defend against pervasive threats. Like worker safety, it has to be a cultural priority starting at the top and made priority #1 in every decision and work process. Even then, security is an illusion. Eventually something or someone will find a way to get through. Zero trust needs to be embraced. Assume every employee, partner, developer and vendor is going to have full internal access and abuse it...then defend from there.

txcwpalpha 7y ago

Hiring an engineer (and by that I assume you mean someone who has the bulk of their experience as a software engineer) as CISO is exactly the opposite of what a company should do. Security is absolutely not the same skill set as software engineering, and it's a huge misconception that people equate infosec with programming. Security engineers of course should be programmers, but an enormous amount of work that goes into infosec has absolutely nothing to do with code, and this is especially true for someone high up in management ranks like a CISO where their entire job is dealing with bureaucracy. Hiring an engineer to be a CISO would be like choosing a biologist to give you surgery instead of a surgeon. Yes, a biologist probably knows a lot about the nitty-gritty of how bodies work, but knowing how the body works and knowing how to perform surgery on a body are two very, very different things. That guy's LinkedIn looks more than qualified to be a CISO, and is certainly more qualified than the vast majority of CISOs I worked with in my career as a security consultant. And on top of all that, he has a degree in computer engineering and has prior experience as an engineer, so I have no idea why you're claiming he isn't an engineer.

goatinaboat 7y ago
I see where you’re coming from but this is not far off the thinking that “an MBA can manage anything”. To use your analogy no surgeon is allowed to cut until he or she does have a solid grounding in biology.
- txcwpalpha 7y ago
  You're right, that wasn't a very good analogy. My point is not to say that a CISO/surgeon shouldn't have any experience in engineering/biology (in fact, as you pointed out, it is the opposite! you ideally want a CISO with some technical chops just as you want a surgeon with some biology knowledge). My point is that there is much more to being a CISO than just technical knowledge. Maybe a better analogy would be choosing someone to represent you in a lawsuit about programming patents. You would want a lawyer representing you, not a programmer. Ideally the lawyer would have some previous experience with these kinds of cases and would lean on programming experts for their knowledge. Maybe they are even a former programmer turned lawyer! But I certainly wouldn't hire "a programmer" to represent me no matter how experienced in programming they are. Linus Torvalds would be a great expert witness, but he isn't going to be my general counsel.
  - mieseratte 7y ago
    I would say the lawsuit example isn't great, lawyer is a specialized profession unto itself. Management has it's own vagaries, but I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering and that was the original point. Having someone with no background in engineering running a department is suspect.
    - txcwpalpha 7y ago
      There's still a disconnect here. Infosec is a specialized profession unto itself, too. A CISO is not just "an engineer that's gone into management". My original point is that security is so far removed from "engineering" that it's incorrect to equate the two (even though it's done all the time). >I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering IME, it's the opposite. It depends on your specific goal (are we trying to train someone to be CISO or are we training them to be a SOC team leader?), but it's ridiculously easier (and more effective) to take a person with existing management abilities and teach them about security than it is to take an engineer and teach them security management skills. >Having someone with no background in engineering running a department is suspect. It's really not, because again, engineering != security. It's no more suspect than the CFO not having a background in engineering.

goatinaboat 7y ago

Wasn’t that the same at Equifax? https://www.marketwatch.com/story/equifax-ceo-hired-a-music-major-as-the-companys-chief-security-officer-2017-09-15 https://www.marketwatch.com/story/equifax-ceo-hired-a-music-...

ttul 7y ago

This is an extreme manipulation of the facts. He has an M.Sc in Computer Science, did R&D at Hewlett-Packard during their golden age, and then spent 22 years at Sandia. This guy was only a bureaucrat in the thinnest interpretation of the word.

raghava 7y ago

What according to you is a qualification to be a CISO, of a bank or a financial institution? I would any day put my money in a bank who has a CISO with such credentials as that of Michael Johnson. He has been an engineer, done R&D, does have the right chops too I guess. And CyberSec has multiple layers - mostly the people, which is the weakest one. And that, my friend, cannot really be solved just by tech.

ilaksh 7y ago

Whatever he was, if the article is to be believed, it seems like his poor management caused the problem. I believe it. This is often the case, where managers actively interfere with priorities that the engineers try to provide. Not only that but he was using resources to play politics. The issue is that fundamentally that's what managers and executives do. Their profession is politicking and manipulation rather than solving problems.