6 ms·

> Executives, especially in the tech industry, have said they're worried that some remote employees are distracted. “Distracted” like the time that Equifax lea

> Executives, especially in the tech industry, have said they're worried that some remote employees are distracted. “Distracted” like the time that Equifax leaked hundreds of millions of pieces of personal data. Maybe instead of blaming the workforce they should worry about making the company a place that people want to work exclusively. Equifax does not matter at all as an organization.

djbusby 4y ago
Sadly, they do matter. Lots of power, low accountability. Equifax and the other two have a very large impact on USA citizens day-to-day. I hate it but, we can't pretend they don't matter.
Fendii 4y ago
Very weird attack from your side. They are big enough it's totally normal that not everyone knows what everyone else is doing. Not sure what the leak is telling you, it's not telling me too much
thwayunion 4y ago
Indeed. In an alternate universe, the Chief Information Security Officer of Equifax is giving interviews about the dangers of work from home for cyber security roles, informed by her masters in music composition and 0.0 years of IC experience as deep expertise. I'm still astounded no one ended up in jail over that. Software Engineering really does need some professionalization.
- denkmoon 4y ago
  >Software Engineering really does need some professionalization. Consequences is what it needs. We can no longer allow it to be profitable to be so brazenly irresponsible. External selection pressure to kill off the maladaptive traits.
  - spydum 4y ago
    i mean ubers former CISO did just get convicted, so it could be starting? (granted his scenario seems more about intent to hide a breach vs ineptitude)
  - thwayunion 4y ago
    That's an excellent point. MBAs-as-CISOs may be more of a symptom of the incentive structure than a cause.
- DoctorNick 4y ago
  >In an alternate universe, the Chief Information Security Officer of Equifax is giving interviews about the dangers of work from home for cyber security roles, informed by her masters in music composition and 0.0 years of IC experience as deep expertise. I'm struggling to understand what the point of this was.
  - jedberg 4y ago
    They're making fun of the fact that during the data breach the CISO was someone with a music degree and no background in security.
    - raydiatian 4y ago
      Holy fuck, I never knew this detail.
      - qzx_pierri 4y ago
        I used to work for the government on systems with extremely sensitive data. I’m talking… penitentiary consequences for data leaks. 90% of the Information Security employees didn’t even have a background in tech OR security. You’d be surprised how incompetent an auditor can be if the security framework simply requires them to blindly fill in responses on boilerplate spreadsheets based on the department’s word alone. For example, risk assessments are performed for all new applications requested by employees. InfoSec: Does this COTS web application have X security control which protects data in transit via encryption acceptable for use in our operating environment? Some bozo from marketing: Yeah, I’m pretty sure. In truth, neither of them are sure. The requester didn’t check, and the auditor saw the word “encryption” on the vendor’s website along with a green padlock in the address bar and that was good enough. The auditor doesn’t even know how check the ciphers being used for this sketchy web application. The control also requires TLS 1.2+ due to the sensitive nature of the data. The auditor marks the security control as “Met” and approves the software request. The auditor is completely incompetent, but is used as a pawn in an elaborate game of “security theater” to abstract away liability. Also, even if the hypothetical security control in the example above wasn’t met, the head of marketing (System Owner) could request an exception be created to skip that security control. Wait, qzx_pierri, you’re telling me that the security control can be skipped? How the hell is that a security CONTROL? I don’t know, and that’s why I quit that depressing industry. To everyone reading this: Stay paranoid, and protect your data yourself if it’s on someone else’s server. "Security" (in America, at least) is often complete bullshit.
- prvit 4y ago
  - rdez6173 4y ago
    The only person that made this about the CISOs gender is you. OPs point was about the lack of credentials, which would apply to anyone. I think it's a reasonable conclusion to draw, due to the nature of the very sensitive data at risk. Having professional accreditation that you should be overseeing the security of peoples most sensitive information is objectively a good idea. Muddying the conversation with virtual signaling is more surprising to see on HN.
    - johnbellone 4y ago
      They were stating the facts around the Equifax breach which is on topic. What is a surprise is the conversation being derailed because someone wanted to make their comment about gender. It isn’t. https://archive.ph/Afnyl https://archive.ph/Afnyl
    - prvit 4y ago
      >The only person that made this about the CISOs gender is you. OPs point was about the lack of credentials, which would apply to anyone. Except it seemingly doesn't apply to literally every other CISO. Does the CISO at Meta have a relevant degree? No. Did Mudge have a relevant degree while he was the CISO at Twitter? No, he also had a music degree. Does Coinbase CISO in charge of securing many billions hold a relevant degree? Nope. Does the CISO at Stripe hold a relevant degree? Again nope. >Having professional accreditation that you should be overseeing the security of peoples most sensitive information is objectively a good idea. It's a good idea, yes! Did some meaningful professional accreditation exist at the time? Nope!
      - thwayunion 4y ago
        The article is about Equifax.
  - cimi_ 4y ago
    I first thought you're right and the joke is not ok - but it's not a joke: https://archive.ph/Afnyl https://archive.ph/Afnyl How is it sexism if it's true? Or should people not bring this up because she's a woman? I think the problem is Equifax's record of handling (non-consenting) user's data, and that causes resentment - not that the CISO was a woman.
teawrecks 4y ago
Yeah I don't buy the complaints about remote workers being distracted. Isn't this the sole purpose of performance reviews? If the employee isn't doing their job, just fire them. Sounds to me like the execs just have control issues. "WE get to fly around in the private jets and strike business deals on the golf course, not you!"
- harles 4y ago
  I think it highlights another problem: performance reviews are heavily bias and management typically has no clue how their reports are actually performing.
jslaD 4y ago
If Equifax leaked personal data it was because of bad security practices… the ones that are implemented by distracted workers.
- ttymck 4y ago
  Specified, delegated and approved by distracted executives? Criminally negligent executives, in my personal opinion.
  - jslaD 4y ago
    I don’t see how any of this was the executives fault. They have no idea of computer security and hired people who they thought were competent to handle it.
    - hobs 4y ago
      No, they didn't. The executive in charge had no freaking idea what was going on, at all. As noted earlier in the threads, it was a music major with no experience, they hired a fall guy/gal - please dont say stuff you have no idea about.
    - lupire 4y ago
      What do you think an exec's job is? Watch TV and hope for the best?
    - xani_ 4y ago
      Nope, the people that were 2 levels under execs hired them Execs hired incompetent (or maybe just "profit oriented") management and that incompetence trickled down to the bottom.
    - raydiatian 4y ago
      https://en.m.wikipedia.org/wiki/Chief_security_officer https://en.m.wikipedia.org/wiki/Chief_security_officer

djbusby 4y ago

Sadly, they do matter. Lots of power, low accountability. Equifax and the other two have a very large impact on USA citizens day-to-day. I hate it but, we can't pretend they don't matter.

Fendii 4y ago

Very weird attack from your side. They are big enough it's totally normal that not everyone knows what everyone else is doing. Not sure what the leak is telling you, it's not telling me too much

thwayunion 4y ago

Indeed. In an alternate universe, the Chief Information Security Officer of Equifax is giving interviews about the dangers of work from home for cyber security roles, informed by her masters in music composition and 0.0 years of IC experience as deep expertise. I'm still astounded no one ended up in jail over that. Software Engineering really does need some professionalization.

denkmoon 4y ago
>Software Engineering really does need some professionalization. Consequences is what it needs. We can no longer allow it to be profitable to be so brazenly irresponsible. External selection pressure to kill off the maladaptive traits.
- spydum 4y ago
  i mean ubers former CISO did just get convicted, so it could be starting? (granted his scenario seems more about intent to hide a breach vs ineptitude)
- thwayunion 4y ago
  That's an excellent point. MBAs-as-CISOs may be more of a symptom of the incentive structure than a cause.
DoctorNick 4y ago
>In an alternate universe, the Chief Information Security Officer of Equifax is giving interviews about the dangers of work from home for cyber security roles, informed by her masters in music composition and 0.0 years of IC experience as deep expertise. I'm struggling to understand what the point of this was.
- jedberg 4y ago
  They're making fun of the fact that during the data breach the CISO was someone with a music degree and no background in security.
  - raydiatian 4y ago
    Holy fuck, I never knew this detail.
    - qzx_pierri 4y ago
      I used to work for the government on systems with extremely sensitive data. I’m talking… penitentiary consequences for data leaks. 90% of the Information Security employees didn’t even have a background in tech OR security. You’d be surprised how incompetent an auditor can be if the security framework simply requires them to blindly fill in responses on boilerplate spreadsheets based on the department’s word alone. For example, risk assessments are performed for all new applications requested by employees. InfoSec: Does this COTS web application have X security control which protects data in transit via encryption acceptable for use in our operating environment? Some bozo from marketing: Yeah, I’m pretty sure. In truth, neither of them are sure. The requester didn’t check, and the auditor saw the word “encryption” on the vendor’s website along with a green padlock in the address bar and that was good enough. The auditor doesn’t even know how check the ciphers being used for this sketchy web application. The control also requires TLS 1.2+ due to the sensitive nature of the data. The auditor marks the security control as “Met” and approves the software request. The auditor is completely incompetent, but is used as a pawn in an elaborate game of “security theater” to abstract away liability. Also, even if the hypothetical security control in the example above wasn’t met, the head of marketing (System Owner) could request an exception be created to skip that security control. Wait, qzx_pierri, you’re telling me that the security control can be skipped? How the hell is that a security CONTROL? I don’t know, and that’s why I quit that depressing industry. To everyone reading this: Stay paranoid, and protect your data yourself if it’s on someone else’s server. "Security" (in America, at least) is often complete bullshit.
prvit 4y ago
- rdez6173 4y ago
  The only person that made this about the CISOs gender is you. OPs point was about the lack of credentials, which would apply to anyone. I think it's a reasonable conclusion to draw, due to the nature of the very sensitive data at risk. Having professional accreditation that you should be overseeing the security of peoples most sensitive information is objectively a good idea. Muddying the conversation with virtual signaling is more surprising to see on HN.
  - johnbellone 4y ago
    They were stating the facts around the Equifax breach which is on topic. What is a surprise is the conversation being derailed because someone wanted to make their comment about gender. It isn’t. https://archive.ph/Afnyl https://archive.ph/Afnyl
  - prvit 4y ago
    >The only person that made this about the CISOs gender is you. OPs point was about the lack of credentials, which would apply to anyone. Except it seemingly doesn't apply to literally every other CISO. Does the CISO at Meta have a relevant degree? No. Did Mudge have a relevant degree while he was the CISO at Twitter? No, he also had a music degree. Does Coinbase CISO in charge of securing many billions hold a relevant degree? Nope. Does the CISO at Stripe hold a relevant degree? Again nope. >Having professional accreditation that you should be overseeing the security of peoples most sensitive information is objectively a good idea. It's a good idea, yes! Did some meaningful professional accreditation exist at the time? Nope!
    - thwayunion 4y ago
      The article is about Equifax.
- cimi_ 4y ago
  I first thought you're right and the joke is not ok - but it's not a joke: https://archive.ph/Afnyl https://archive.ph/Afnyl How is it sexism if it's true? Or should people not bring this up because she's a woman? I think the problem is Equifax's record of handling (non-consenting) user's data, and that causes resentment - not that the CISO was a woman.

teawrecks 4y ago

Yeah I don't buy the complaints about remote workers being distracted. Isn't this the sole purpose of performance reviews? If the employee isn't doing their job, just fire them. Sounds to me like the execs just have control issues. "WE get to fly around in the private jets and strike business deals on the golf course, not you!"

harles 4y ago
I think it highlights another problem: performance reviews are heavily bias and management typically has no clue how their reports are actually performing.

jslaD 4y ago

If Equifax leaked personal data it was because of bad security practices… the ones that are implemented by distracted workers.

ttymck 4y ago
Specified, delegated and approved by distracted executives? Criminally negligent executives, in my personal opinion.
- jslaD 4y ago
  I don’t see how any of this was the executives fault. They have no idea of computer security and hired people who they thought were competent to handle it.
  - hobs 4y ago
    No, they didn't. The executive in charge had no freaking idea what was going on, at all. As noted earlier in the threads, it was a music major with no experience, they hired a fall guy/gal - please dont say stuff you have no idea about.
  - lupire 4y ago
    What do you think an exec's job is? Watch TV and hope for the best?
  - xani_ 4y ago
    Nope, the people that were 2 levels under execs hired them Execs hired incompetent (or maybe just "profit oriented") management and that incompetence trickled down to the bottom.
  - raydiatian 4y ago
    https://en.m.wikipedia.org/wiki/Chief_security_officer https://en.m.wikipedia.org/wiki/Chief_security_officer