4 ms·

Filed under: Things so true they're nearly physics. "Please stop putting a Major or Lt Col. (despite their devotion, exceptional attitude, and culture) in char

Filed under: Things so true they're nearly physics. "Please stop putting a Major or Lt Col. (despite their devotion, exceptional attitude, and culture) in charge of ICAM, Zero Trust or Cloud for 1 to 4 million users when they have no previous experience in that field—we are setting up critical infrastructure to fail." Past that, there are some other people who shouldn't ever get near cybersecurity management - legislators. Specifically the majority who are willfully clueless.

Waterluvian 5y ago
Like safety, security is a cost centre with catastrophic penalties for getting wrong. Absolutely any attempt to run it like we run other parts of an organization is a guaranteed way to create a disaster. P.S. “Things so true they’re nearly physics” might be my favourite line this year.
- hulitu 5y ago
  > Like safety, security is a cost centre with catastrophic penalties for getting wrong. The main problem is that this cost center does generate any revenue. Try to explain this to a CFO.
sushsjsuauahab 5y ago
While I probably agree, why can't the Major just be the project manager and he or she consults daily with their trusted, deeply responsible technical advisor who is actually from the industry?
- WarOnPrivacy 5y ago
  Because the major is unqualified to evaluate the guidance they receive. Same reason we don't randomly pick our battlefield generals from a pool of chimney sweeps.
- ARandomerDude 5y ago
  Former USAF officer here. Part of the problem is that a Major or Lt Col does not have the rank or budget necessary to pull off a project of that scale. They are still too low on the chain, and too easy to override and then scapegoat when the project fails. Moreover, the officer system is "up or out" meaning that a field grade officer will always be incentivized to prioritize short-term paper gains over long-term strategic gains. This is a bad thing when designing critical infrastructure. A more senior officer with longer tenure and a bigger budget (i.e., a General or SES) needs to run a project intended for millions of users in a defense context.
  - sushsjsuauahab 5y ago
    Appreciate the perspective, I didn't realize that there was much higher up to go :) Makes sense!
- obstacle1 5y ago
  Seems ripe for exploitation. What's stopping the PM-but-really-Major from invoking chain of command and making overriding decisions? In an org like the military I'm not sure you could just say "please act like a PM and don't make broader decisions" to someone with seniority and expect them to not exercise their authority, unless you actually revoke their authority. Or, what's stopping the Major from installing a friendly and symbolic tech advisor? Stranger things have happened than bureaucrats hiring and building departments designed to do nothing but legitimize and push forward their own agenda.
smoldesu 5y ago
My favorite is Sakurada, the cybersecurity expert who's allegedly never touched a computer. Can't hit what you can't see! https://www.bbc.com/news/technology-46222026 https://www.bbc.com/news/technology-46222026
- AutumnCurtain 5y ago
  If everyone followed his lead, cybercrime would cease to exist. He's leading by example
- hanniabu 5y ago
  Ironically a cybersecurity expert would know nothing is secure and not have a computer

Waterluvian 5y ago

Like safety, security is a cost centre with catastrophic penalties for getting wrong. Absolutely any attempt to run it like we run other parts of an organization is a guaranteed way to create a disaster. P.S. “Things so true they’re nearly physics” might be my favourite line this year.

hulitu 5y ago
> Like safety, security is a cost centre with catastrophic penalties for getting wrong. The main problem is that this cost center does generate any revenue. Try to explain this to a CFO.

sushsjsuauahab 5y ago

While I probably agree, why can't the Major just be the project manager and he or she consults daily with their trusted, deeply responsible technical advisor who is actually from the industry?

WarOnPrivacy 5y ago
Because the major is unqualified to evaluate the guidance they receive. Same reason we don't randomly pick our battlefield generals from a pool of chimney sweeps.
ARandomerDude 5y ago
Former USAF officer here. Part of the problem is that a Major or Lt Col does not have the rank or budget necessary to pull off a project of that scale. They are still too low on the chain, and too easy to override and then scapegoat when the project fails. Moreover, the officer system is "up or out" meaning that a field grade officer will always be incentivized to prioritize short-term paper gains over long-term strategic gains. This is a bad thing when designing critical infrastructure. A more senior officer with longer tenure and a bigger budget (i.e., a General or SES) needs to run a project intended for millions of users in a defense context.
- sushsjsuauahab 5y ago
  Appreciate the perspective, I didn't realize that there was much higher up to go :) Makes sense!
obstacle1 5y ago
Seems ripe for exploitation. What's stopping the PM-but-really-Major from invoking chain of command and making overriding decisions? In an org like the military I'm not sure you could just say "please act like a PM and don't make broader decisions" to someone with seniority and expect them to not exercise their authority, unless you actually revoke their authority. Or, what's stopping the Major from installing a friendly and symbolic tech advisor? Stranger things have happened than bureaucrats hiring and building departments designed to do nothing but legitimize and push forward their own agenda.

smoldesu 5y ago

My favorite is Sakurada, the cybersecurity expert who's allegedly never touched a computer. Can't hit what you can't see! https://www.bbc.com/news/technology-46222026 https://www.bbc.com/news/technology-46222026

AutumnCurtain 5y ago
If everyone followed his lead, cybercrime would cease to exist. He's leading by example
hanniabu 5y ago
Ironically a cybersecurity expert would know nothing is secure and not have a computer