6 ms·

This part really stood out to me: "Mr. Agrawal said the “nature of this situation” limited what he was allowed to share with employees" Even when things are a

This part really stood out to me: "Mr. Agrawal said the “nature of this situation” limited what he was allowed to share with employees" Even when things are a bit contentious, companies and C-level execs like CISOs usually come to an agreement and have a joint statement about 'spending time with family' or 'pursuing other endeavors'. This sounds like it was either very one-sided, or something very bad was happening...

tyingq 5y ago
I can see that happening with a CISO, though, in many scenarios. Like if they presented a stark picture of current state and said that work needed to happen that would put planned revenue generating work on hold. And weren't willing to back down on the opinion that it was that critical. I imagine they wouldn't want to cite differences of opinion on security posture as the reason for departing.
- kune 5y ago
  Somebody told me a few years back that the life time of a CISO in a larger organisation is not larger than 24 months. In my organisation that proved to be true so far. Here the rule applies as well.
  - Phlarp 5y ago
    It really feels like the CISO role has become less about the security posture of an organization and more about being a corporate whipping boy-- Predesignated as the go-to sacrificial lamb for when a public leak or government investigation comes knocking. Hard to find longevity or stability in a role that exists to fail
    - BeFlatXIII 5y ago
      Once this is known throughout the industry, it also means that the whipping boys keep getting fired and then taking up their next tenure at the startup next door until they're fired again.
    - tptacek 5y ago
      To the extent that's true, it sure doesn't seem to stop high-profile people with lots to lose from taking that role.
      - michaelcampbell 5y ago
        $$$, golden parachutes, quick vesting equity...
      - hn_throwaway_99 5y ago
        CISO's get paid a ton of money to be that sacrificial lamb. At the same time, since it's widely known that the post is a sacrificial lamb post, there is really not that much to lose.
  - MattPalmer1086 5y ago
    A CISO told me that the role was to beg for resources and then to get fired if something goes wrong.
    - hn_throwaway_99 5y ago
      Having seen how some CISOs "beg for resources", I pretty fundamentally believe most of this money is wasted anyway. The only way you can really get better security at a company is to have an ingrained security culture. I.e. developers are continually educated on secure coding practices and new threats, code reviews include security checklists, corporate security training includes continual social engineering tests and an atmosphere of continual improvement. And yes, that stuff does cost money, but that's rarely the resources I see CISO's fight for. Instead, they fight for lots of expensive software, things like useless, shitty WAFs or poorly built "network monitoring" software (which can be a huge threat vector in itself, just see the SolarWinds fiasco). Like many other comments here, I don't believe security is something you can "bolt on" at a company. Yes, there are specialized roles that a dedicated security team needs to fill, but unless everyone at the company has a true understanding of the value and importance of security vigilance, you're screwed.
      - cutemonster 5y ago
        > code reviews include security checklists, Can I have a checklist please? Full stack web dev Edit: Here I found one https://www.michaelagreiler.com/security-code-review-checklist/ https://www.michaelagreiler.com/security-code-review-checkli...
        MattPalmer1086 5y ago
        There are some bits phrased the wrong way around (e.g. are session parameters passed in URLs? Check!). You don't want to do that. But as list of things to consider, if you already understand what you're doing, its not too bad.
      - MattPalmer1086 5y ago
        It's a huge problem in security to know what money is wasted or not. Not hacked yet? Lucky or wise? It's probably like the old saw about advertising. Half of all it is useless, we just don't know which half!
  - saagarjha 5y ago
    Perhaps they should check to see if they ever denied the position to Lord Voldemort.
  - edmundsauto 5y ago
    I’ve been told similar for CMO - < 1 year tenure on average. The narrative was that CMO are weirdly in a mix of technical and creative and accounting, meaning they need to come up with answers and execution that satisfy CEOs. So either the company does well and the CMO stays, or not. And the default for most companies is to fail.
- staticassertion 5y ago
  It's hard to imagine anyone being that bad of a CISO. No CISO is going to say "shut down the business while we figure out security", not one who's been a CISO multiple times at least. And then for them to not back down or discuss things? Unlikely. More likely they just weren't getting things done fast enough. CISOs come and go - they're a very short lived position.
  - tyingq 5y ago
    >More likely they just weren't getting things done fast enough I'd be surprised if that warranted the “nature of this situation” language.
    - staticassertion 5y ago
      It could mean so many things tbh. It's true though, it's a very odd way to phrase it. It certainly doesn't feel like a typical CISO exit, but idk.
    - tptacek 5y ago
      If it's a straight-up termination, that's what you'd expect the company to say (it's extremely unusual for a company to provide backstory for why they're firing senior management, even if the reason is really boring, like "we've lost confidence in the current path the organization is on and feel like we need to take a new direction").
      - aerostable_slug 5y ago
        I find it odd the CISO gets two weeks to transition things while the Head of Security (does that get an acronym?) got shown to the door. The latter doesn't seem as much like a straight-up termination for ordinary performance reasons. Then again, I was at a large company where the CISO managed to get insta-fired in a 1:1 with the CIO. I actually saw the person about two minutes after it happened while they were grabbing their jacket and heading for the door — I don't know what was said, but judging by appearances things got really heated and the CIO had enough. Corporate security appeared shortly to begin boxing things up.
- aerostable_slug 5y ago
  Note that Zatko was the Head of Security and apparently immediately terminated. Sethi (CISO) gets a couple of weeks' transition. I have no idea if that has to do with their day-to-day roles or the specifics of why they were let go, but it is all a bit interesting.
jms703 5y ago
Sounds more like performance and execution problems.
throwdown2 5y ago
Wonder if it has something to do with Elon Musk's recent tweet? https://twitter.com/elonmusk/status/1482858149900136448 https://twitter.com/elonmusk/status/1482858149900136448

tyingq 5y ago

I can see that happening with a CISO, though, in many scenarios. Like if they presented a stark picture of current state and said that work needed to happen that would put planned revenue generating work on hold. And weren't willing to back down on the opinion that it was that critical. I imagine they wouldn't want to cite differences of opinion on security posture as the reason for departing.

kune 5y ago
Somebody told me a few years back that the life time of a CISO in a larger organisation is not larger than 24 months. In my organisation that proved to be true so far. Here the rule applies as well.
- Phlarp 5y ago
  It really feels like the CISO role has become less about the security posture of an organization and more about being a corporate whipping boy-- Predesignated as the go-to sacrificial lamb for when a public leak or government investigation comes knocking. Hard to find longevity or stability in a role that exists to fail
  - BeFlatXIII 5y ago
    Once this is known throughout the industry, it also means that the whipping boys keep getting fired and then taking up their next tenure at the startup next door until they're fired again.
  - tptacek 5y ago
    To the extent that's true, it sure doesn't seem to stop high-profile people with lots to lose from taking that role.
    - michaelcampbell 5y ago
      $$$, golden parachutes, quick vesting equity...
    - hn_throwaway_99 5y ago
      CISO's get paid a ton of money to be that sacrificial lamb. At the same time, since it's widely known that the post is a sacrificial lamb post, there is really not that much to lose.
- MattPalmer1086 5y ago
  A CISO told me that the role was to beg for resources and then to get fired if something goes wrong.
  - hn_throwaway_99 5y ago
    Having seen how some CISOs "beg for resources", I pretty fundamentally believe most of this money is wasted anyway. The only way you can really get better security at a company is to have an ingrained security culture. I.e. developers are continually educated on secure coding practices and new threats, code reviews include security checklists, corporate security training includes continual social engineering tests and an atmosphere of continual improvement. And yes, that stuff does cost money, but that's rarely the resources I see CISO's fight for. Instead, they fight for lots of expensive software, things like useless, shitty WAFs or poorly built "network monitoring" software (which can be a huge threat vector in itself, just see the SolarWinds fiasco). Like many other comments here, I don't believe security is something you can "bolt on" at a company. Yes, there are specialized roles that a dedicated security team needs to fill, but unless everyone at the company has a true understanding of the value and importance of security vigilance, you're screwed.
    - cutemonster 5y ago
      > code reviews include security checklists, Can I have a checklist please? Full stack web dev Edit: Here I found one https://www.michaelagreiler.com/security-code-review-checklist/ https://www.michaelagreiler.com/security-code-review-checkli...
      - MattPalmer1086 5y ago
        There are some bits phrased the wrong way around (e.g. are session parameters passed in URLs? Check!). You don't want to do that. But as list of things to consider, if you already understand what you're doing, its not too bad.
    - MattPalmer1086 5y ago
      It's a huge problem in security to know what money is wasted or not. Not hacked yet? Lucky or wise? It's probably like the old saw about advertising. Half of all it is useless, we just don't know which half!
- saagarjha 5y ago
  Perhaps they should check to see if they ever denied the position to Lord Voldemort.
- edmundsauto 5y ago
  I’ve been told similar for CMO - < 1 year tenure on average. The narrative was that CMO are weirdly in a mix of technical and creative and accounting, meaning they need to come up with answers and execution that satisfy CEOs. So either the company does well and the CMO stays, or not. And the default for most companies is to fail.
staticassertion 5y ago
It's hard to imagine anyone being that bad of a CISO. No CISO is going to say "shut down the business while we figure out security", not one who's been a CISO multiple times at least. And then for them to not back down or discuss things? Unlikely. More likely they just weren't getting things done fast enough. CISOs come and go - they're a very short lived position.
- tyingq 5y ago
  >More likely they just weren't getting things done fast enough I'd be surprised if that warranted the “nature of this situation” language.
  - staticassertion 5y ago
    It could mean so many things tbh. It's true though, it's a very odd way to phrase it. It certainly doesn't feel like a typical CISO exit, but idk.
  - tptacek 5y ago
    If it's a straight-up termination, that's what you'd expect the company to say (it's extremely unusual for a company to provide backstory for why they're firing senior management, even if the reason is really boring, like "we've lost confidence in the current path the organization is on and feel like we need to take a new direction").
    - aerostable_slug 5y ago
      I find it odd the CISO gets two weeks to transition things while the Head of Security (does that get an acronym?) got shown to the door. The latter doesn't seem as much like a straight-up termination for ordinary performance reasons. Then again, I was at a large company where the CISO managed to get insta-fired in a 1:1 with the CIO. I actually saw the person about two minutes after it happened while they were grabbing their jacket and heading for the door — I don't know what was said, but judging by appearances things got really heated and the CIO had enough. Corporate security appeared shortly to begin boxing things up.
aerostable_slug 5y ago
Note that Zatko was the Head of Security and apparently immediately terminated. Sethi (CISO) gets a couple of weeks' transition. I have no idea if that has to do with their day-to-day roles or the specifics of why they were let go, but it is all a bit interesting.

jms703 5y ago

Sounds more like performance and execution problems.

throwdown2 5y ago

Wonder if it has something to do with Elon Musk's recent tweet? https://twitter.com/elonmusk/status/1482858149900136448 https://twitter.com/elonmusk/status/1482858149900136448