4 ms·

> it's not down to him to chose what the CEO decides should be presented to the board, Isn't it? Does the CEO get to carte blanche decide to hide security hol

> it's not down to him to chose what the CEO decides should be presented to the board, Isn't it? Does the CEO get to carte blanche decide to hide security holes from the board?

SilverBirch 4y ago
In practical terms pretty much yes. The CEO gets pretty wide latitude. Let's start from a pretty standard premise - there are security holes in every company. Clearly we're not going to disclose every single one to the board. So it's up to the CEO to make the judgement on when something rises to the importance of needing to notify the board or needs input from the board. The board is there for strategy, not for operations. So as long as there's nothing relevant to the high level strategy, there's no real reason to tell them about individual operational issues. An obvious example here, is that Mudge cites that Agrawal tells the board that they have end point management, but Mudge knows the end point management shows lots of devices aren't secure. The end points being insecure isn't a problem to bring to the board, as long as you have a strategy to rectify it- which presumably they do, since that's why they've instituted end point management in the first place. And remember, the board knows that they've got security issues and they're addressing them, because the board approved them hiring Mudge as head of security in the first place. So the question is why the Head of Security thinks he needs to go and advise the board of all of the operational issues he's tackling. They know there are issues, that's why he's employed.
- peteradio 4y ago
  A strategy like "manage endpoints" would not be satisfied if people are actively able to avoid it, no? Wouldn't that mean the board's strategy is being ignored and evidence of it concealed by the CEO?
  - SilverBirch 4y ago
    The question isn't "Right at this moment is everything good" it's "do we have a strategy to get to the point where everything is good". So sure, the first thing you're going to find when you implement endpoint management is lots of devices are breaching the requirements, the important thing is to then address that - not to just go back to the board and say "things are really bad".
    - peteradio 4y ago
      I'm curious where the line might be then, at what point would it be problematic for the CEO to prevent this particular issue surfacing? Or is the onus on the board to ask for specific feedback?
      - SilverBirch 4y ago
        I think there's two clear criteria for what would rise to the board: Firstly, somthing that clearly raises legal liability - for example discovering a hack that must be disclosed publicly, that sort of thing. Or something that clearly causes a rethink in strategy. Now, I could absolutely see a scenario where Mudge comes in and goes "This is terrible, we need to massively change our plan and massively increase our focus on security" and Agrawal basically disagrees. At the end of the day it's a judgement call, so it's down to Agrawal.
        peteradio 4y ago
        I could see a CEO getting in the way of a pretty clear board mandate and getting fired for it, maybe there needs to be a sacrificial someone to make that happen. I haven't really seen good evidence in my short tenure to believe that one man should be making all judgement calls for a business, although that is how I guess everything is structured for some reason. Thanks for the insights.
  - danielmarkbruce 4y ago
    If the CEO put the level of detail around endpoint security that "mudge" implies he should have, the board would wonder if they've hired the wrong CEO.

> it's not down to him to chose what the CEO decides should be presented to the board, Isn't it? Does the CEO get to carte blanche decide to hide security holes from the board?

SilverBirch 4y ago

In practical terms pretty much yes. The CEO gets pretty wide latitude. Let's start from a pretty standard premise - there are security holes in every company. Clearly we're not going to disclose every single one to the board. So it's up to the CEO to make the judgement on when something rises to the importance of needing to notify the board or needs input from the board. The board is there for strategy, not for operations. So as long as there's nothing relevant to the high level strategy, there's no real reason to tell them about individual operational issues. An obvious example here, is that Mudge cites that Agrawal tells the board that they have end point management, but Mudge knows the end point management shows lots of devices aren't secure. The end points being insecure isn't a problem to bring to the board, as long as you have a strategy to rectify it- which presumably they do, since that's why they've instituted end point management in the first place. And remember, the board knows that they've got security issues and they're addressing them, because the board approved them hiring Mudge as head of security in the first place. So the question is why the Head of Security thinks he needs to go and advise the board of all of the operational issues he's tackling. They know there are issues, that's why he's employed.

peteradio 4y ago
A strategy like "manage endpoints" would not be satisfied if people are actively able to avoid it, no? Wouldn't that mean the board's strategy is being ignored and evidence of it concealed by the CEO?
- SilverBirch 4y ago
  The question isn't "Right at this moment is everything good" it's "do we have a strategy to get to the point where everything is good". So sure, the first thing you're going to find when you implement endpoint management is lots of devices are breaching the requirements, the important thing is to then address that - not to just go back to the board and say "things are really bad".
  - peteradio 4y ago
    I'm curious where the line might be then, at what point would it be problematic for the CEO to prevent this particular issue surfacing? Or is the onus on the board to ask for specific feedback?
    - SilverBirch 4y ago
      I think there's two clear criteria for what would rise to the board: Firstly, somthing that clearly raises legal liability - for example discovering a hack that must be disclosed publicly, that sort of thing. Or something that clearly causes a rethink in strategy. Now, I could absolutely see a scenario where Mudge comes in and goes "This is terrible, we need to massively change our plan and massively increase our focus on security" and Agrawal basically disagrees. At the end of the day it's a judgement call, so it's down to Agrawal.
      - peteradio 4y ago
        I could see a CEO getting in the way of a pretty clear board mandate and getting fired for it, maybe there needs to be a sacrificial someone to make that happen. I haven't really seen good evidence in my short tenure to believe that one man should be making all judgement calls for a business, although that is how I guess everything is structured for some reason. Thanks for the insights.
- danielmarkbruce 4y ago
  If the CEO put the level of detail around endpoint security that "mudge" implies he should have, the board would wonder if they've hired the wrong CEO.