4 ms·

Hiring an engineer (and by that I assume you mean someone who has the bulk of their experience as a software engineer) as CISO is exactly the opposite of what a

Hiring an engineer (and by that I assume you mean someone who has the bulk of their experience as a software engineer) as CISO is exactly the opposite of what a company should do. Security is absolutely not the same skill set as software engineering, and it's a huge misconception that people equate infosec with programming. Security engineers of course should be programmers, but an enormous amount of work that goes into infosec has absolutely nothing to do with code, and this is especially true for someone high up in management ranks like a CISO where their entire job is dealing with bureaucracy. Hiring an engineer to be a CISO would be like choosing a biologist to give you surgery instead of a surgeon. Yes, a biologist probably knows a lot about the nitty-gritty of how bodies work, but knowing how the body works and knowing how to perform surgery on a body are two very, very different things. That guy's LinkedIn looks more than qualified to be a CISO, and is certainly more qualified than the vast majority of CISOs I worked with in my career as a security consultant. And on top of all that, he has a degree in computer engineering and has prior experience as an engineer, so I have no idea why you're claiming he isn't an engineer.

goatinaboat 7y ago
I see where you’re coming from but this is not far off the thinking that “an MBA can manage anything”. To use your analogy no surgeon is allowed to cut until he or she does have a solid grounding in biology.
- txcwpalpha 7y ago
  You're right, that wasn't a very good analogy. My point is not to say that a CISO/surgeon shouldn't have any experience in engineering/biology (in fact, as you pointed out, it is the opposite! you ideally want a CISO with some technical chops just as you want a surgeon with some biology knowledge). My point is that there is much more to being a CISO than just technical knowledge. Maybe a better analogy would be choosing someone to represent you in a lawsuit about programming patents. You would want a lawyer representing you, not a programmer. Ideally the lawyer would have some previous experience with these kinds of cases and would lean on programming experts for their knowledge. Maybe they are even a former programmer turned lawyer! But I certainly wouldn't hire "a programmer" to represent me no matter how experienced in programming they are. Linus Torvalds would be a great expert witness, but he isn't going to be my general counsel.
  - mieseratte 7y ago
    I would say the lawsuit example isn't great, lawyer is a specialized profession unto itself. Management has it's own vagaries, but I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering and that was the original point. Having someone with no background in engineering running a department is suspect.
    - txcwpalpha 7y ago
      There's still a disconnect here. Infosec is a specialized profession unto itself, too. A CISO is not just "an engineer that's gone into management". My original point is that security is so far removed from "engineering" that it's incorrect to equate the two (even though it's done all the time). >I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering IME, it's the opposite. It depends on your specific goal (are we trying to train someone to be CISO or are we training them to be a SOC team leader?), but it's ridiculously easier (and more effective) to take a person with existing management abilities and teach them about security than it is to take an engineer and teach them security management skills. >Having someone with no background in engineering running a department is suspect. It's really not, because again, engineering != security. It's no more suspect than the CFO not having a background in engineering.
- crygin 7y ago
  To use your analogy no surgeon is allowed to cut until he or she does have a solid grounding in biology. I take it you're unfamiliar with the content of the MCAT exam, which is a prerequisite to admission to American medical schools.
ownagefool 7y ago
It's difficult because the CISO runs the budget, and a non-technical CISO, in my experience, is much more likely to buy products and not hire people needed to use them. Think about it this way: publications are telling you that ~92% of Cyber attacks start from an end users device. Probably true, but are we talking about a device being owned here or just are we discussing actual PII data loss? More importantly, whilst Gartner and co is telling you what products you need to buy to defend against this, what they aren't telling you is the best product only has a 52% attack detection rate. And this only accounts for known attack vectors. So you're a CISO, you're 15 million down on products, 5 million down on risk people, without a Software Developer, Sysadmin or Release Engineer on your team. The actual Engineering team ignores you because you keep raising stupid concerns. Would this have happened if you were technical? Maybe, you'd have a different set of problems.
treypitt 7y ago
not sure a biologist knows more about the body than a surgeon. isn't it more like asking a surgeon to run the department?
rconti 7y ago
Sounds like they hired a CISO with a toxic personality more interested in internal PR than security, and all the talent ran off. Sounds like this is the exact opposite of what any company should do.

goatinaboat 7y ago

I see where you’re coming from but this is not far off the thinking that “an MBA can manage anything”. To use your analogy no surgeon is allowed to cut until he or she does have a solid grounding in biology.

txcwpalpha 7y ago
You're right, that wasn't a very good analogy. My point is not to say that a CISO/surgeon shouldn't have any experience in engineering/biology (in fact, as you pointed out, it is the opposite! you ideally want a CISO with some technical chops just as you want a surgeon with some biology knowledge). My point is that there is much more to being a CISO than just technical knowledge. Maybe a better analogy would be choosing someone to represent you in a lawsuit about programming patents. You would want a lawyer representing you, not a programmer. Ideally the lawyer would have some previous experience with these kinds of cases and would lean on programming experts for their knowledge. Maybe they are even a former programmer turned lawyer! But I certainly wouldn't hire "a programmer" to represent me no matter how experienced in programming they are. Linus Torvalds would be a great expert witness, but he isn't going to be my general counsel.
- mieseratte 7y ago
  I would say the lawsuit example isn't great, lawyer is a specialized profession unto itself. Management has it's own vagaries, but I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering and that was the original point. Having someone with no background in engineering running a department is suspect.
  - txcwpalpha 7y ago
    There's still a disconnect here. Infosec is a specialized profession unto itself, too. A CISO is not just "an engineer that's gone into management". My original point is that security is so far removed from "engineering" that it's incorrect to equate the two (even though it's done all the time). >I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering IME, it's the opposite. It depends on your specific goal (are we trying to train someone to be CISO or are we training them to be a SOC team leader?), but it's ridiculously easier (and more effective) to take a person with existing management abilities and teach them about security than it is to take an engineer and teach them security management skills. >Having someone with no background in engineering running a department is suspect. It's really not, because again, engineering != security. It's no more suspect than the CFO not having a background in engineering.
crygin 7y ago
To use your analogy no surgeon is allowed to cut until he or she does have a solid grounding in biology. I take it you're unfamiliar with the content of the MCAT exam, which is a prerequisite to admission to American medical schools.

ownagefool 7y ago

It's difficult because the CISO runs the budget, and a non-technical CISO, in my experience, is much more likely to buy products and not hire people needed to use them. Think about it this way: publications are telling you that ~92% of Cyber attacks start from an end users device. Probably true, but are we talking about a device being owned here or just are we discussing actual PII data loss? More importantly, whilst Gartner and co is telling you what products you need to buy to defend against this, what they aren't telling you is the best product only has a 52% attack detection rate. And this only accounts for known attack vectors. So you're a CISO, you're 15 million down on products, 5 million down on risk people, without a Software Developer, Sysadmin or Release Engineer on your team. The actual Engineering team ignores you because you keep raising stupid concerns. Would this have happened if you were technical? Maybe, you'd have a different set of problems.

treypitt 7y ago

not sure a biologist knows more about the body than a surgeon. isn't it more like asking a surgeon to run the department?

rconti 7y ago

Sounds like they hired a CISO with a toxic personality more interested in internal PR than security, and all the talent ran off. Sounds like this is the exact opposite of what any company should do.