6 ms·

Indeed. In an alternate universe, the Chief Information Security Officer of Equifax is giving interviews about the dangers of work from home for cyber security

Indeed. In an alternate universe, the Chief Information Security Officer of Equifax is giving interviews about the dangers of work from home for cyber security roles, informed by her masters in music composition and 0.0 years of IC experience as deep expertise. I'm still astounded no one ended up in jail over that. Software Engineering really does need some professionalization.

denkmoon 4y ago
>Software Engineering really does need some professionalization. Consequences is what it needs. We can no longer allow it to be profitable to be so brazenly irresponsible. External selection pressure to kill off the maladaptive traits.
- spydum 4y ago
  i mean ubers former CISO did just get convicted, so it could be starting? (granted his scenario seems more about intent to hide a breach vs ineptitude)
- thwayunion 4y ago
  That's an excellent point. MBAs-as-CISOs may be more of a symptom of the incentive structure than a cause.
DoctorNick 4y ago
>In an alternate universe, the Chief Information Security Officer of Equifax is giving interviews about the dangers of work from home for cyber security roles, informed by her masters in music composition and 0.0 years of IC experience as deep expertise. I'm struggling to understand what the point of this was.
- jedberg 4y ago
  They're making fun of the fact that during the data breach the CISO was someone with a music degree and no background in security.
  - raydiatian 4y ago
    Holy fuck, I never knew this detail.
    - qzx_pierri 4y ago
      I used to work for the government on systems with extremely sensitive data. I’m talking… penitentiary consequences for data leaks. 90% of the Information Security employees didn’t even have a background in tech OR security. You’d be surprised how incompetent an auditor can be if the security framework simply requires them to blindly fill in responses on boilerplate spreadsheets based on the department’s word alone. For example, risk assessments are performed for all new applications requested by employees. InfoSec: Does this COTS web application have X security control which protects data in transit via encryption acceptable for use in our operating environment? Some bozo from marketing: Yeah, I’m pretty sure. In truth, neither of them are sure. The requester didn’t check, and the auditor saw the word “encryption” on the vendor’s website along with a green padlock in the address bar and that was good enough. The auditor doesn’t even know how check the ciphers being used for this sketchy web application. The control also requires TLS 1.2+ due to the sensitive nature of the data. The auditor marks the security control as “Met” and approves the software request. The auditor is completely incompetent, but is used as a pawn in an elaborate game of “security theater” to abstract away liability. Also, even if the hypothetical security control in the example above wasn’t met, the head of marketing (System Owner) could request an exception be created to skip that security control. Wait, qzx_pierri, you’re telling me that the security control can be skipped? How the hell is that a security CONTROL? I don’t know, and that’s why I quit that depressing industry. To everyone reading this: Stay paranoid, and protect your data yourself if it’s on someone else’s server. "Security" (in America, at least) is often complete bullshit.
    - prvit 4y ago
      It's a nasty sexist lie. The person had no relevant degree (as is the case for most people working in security roles, because such degrees didn't exist until very recently). The person did have a literal decades of relevant experience, working in security.
prvit 4y ago
- rdez6173 4y ago
  The only person that made this about the CISOs gender is you. OPs point was about the lack of credentials, which would apply to anyone. I think it's a reasonable conclusion to draw, due to the nature of the very sensitive data at risk. Having professional accreditation that you should be overseeing the security of peoples most sensitive information is objectively a good idea. Muddying the conversation with virtual signaling is more surprising to see on HN.
  - johnbellone 4y ago
    They were stating the facts around the Equifax breach which is on topic. What is a surprise is the conversation being derailed because someone wanted to make their comment about gender. It isn’t. https://archive.ph/Afnyl https://archive.ph/Afnyl
  - prvit 4y ago
    >The only person that made this about the CISOs gender is you. OPs point was about the lack of credentials, which would apply to anyone. Except it seemingly doesn't apply to literally every other CISO. Does the CISO at Meta have a relevant degree? No. Did Mudge have a relevant degree while he was the CISO at Twitter? No, he also had a music degree. Does Coinbase CISO in charge of securing many billions hold a relevant degree? Nope. Does the CISO at Stripe hold a relevant degree? Again nope. >Having professional accreditation that you should be overseeing the security of peoples most sensitive information is objectively a good idea. It's a good idea, yes! Did some meaningful professional accreditation exist at the time? Nope!
    - thwayunion 4y ago
      The article is about Equifax.
- cimi_ 4y ago
  I first thought you're right and the joke is not ok - but it's not a joke: https://archive.ph/Afnyl https://archive.ph/Afnyl How is it sexism if it's true? Or should people not bring this up because she's a woman? I think the problem is Equifax's record of handling (non-consenting) user's data, and that causes resentment - not that the CISO was a woman.

denkmoon 4y ago

>Software Engineering really does need some professionalization. Consequences is what it needs. We can no longer allow it to be profitable to be so brazenly irresponsible. External selection pressure to kill off the maladaptive traits.

spydum 4y ago
i mean ubers former CISO did just get convicted, so it could be starting? (granted his scenario seems more about intent to hide a breach vs ineptitude)
thwayunion 4y ago
That's an excellent point. MBAs-as-CISOs may be more of a symptom of the incentive structure than a cause.

DoctorNick 4y ago

>In an alternate universe, the Chief Information Security Officer of Equifax is giving interviews about the dangers of work from home for cyber security roles, informed by her masters in music composition and 0.0 years of IC experience as deep expertise. I'm struggling to understand what the point of this was.

jedberg 4y ago
They're making fun of the fact that during the data breach the CISO was someone with a music degree and no background in security.
- raydiatian 4y ago
  Holy fuck, I never knew this detail.
  - qzx_pierri 4y ago
    I used to work for the government on systems with extremely sensitive data. I’m talking… penitentiary consequences for data leaks. 90% of the Information Security employees didn’t even have a background in tech OR security. You’d be surprised how incompetent an auditor can be if the security framework simply requires them to blindly fill in responses on boilerplate spreadsheets based on the department’s word alone. For example, risk assessments are performed for all new applications requested by employees. InfoSec: Does this COTS web application have X security control which protects data in transit via encryption acceptable for use in our operating environment? Some bozo from marketing: Yeah, I’m pretty sure. In truth, neither of them are sure. The requester didn’t check, and the auditor saw the word “encryption” on the vendor’s website along with a green padlock in the address bar and that was good enough. The auditor doesn’t even know how check the ciphers being used for this sketchy web application. The control also requires TLS 1.2+ due to the sensitive nature of the data. The auditor marks the security control as “Met” and approves the software request. The auditor is completely incompetent, but is used as a pawn in an elaborate game of “security theater” to abstract away liability. Also, even if the hypothetical security control in the example above wasn’t met, the head of marketing (System Owner) could request an exception be created to skip that security control. Wait, qzx_pierri, you’re telling me that the security control can be skipped? How the hell is that a security CONTROL? I don’t know, and that’s why I quit that depressing industry. To everyone reading this: Stay paranoid, and protect your data yourself if it’s on someone else’s server. "Security" (in America, at least) is often complete bullshit.
  - prvit 4y ago
    It's a nasty sexist lie. The person had no relevant degree (as is the case for most people working in security roles, because such degrees didn't exist until very recently). The person did have a literal decades of relevant experience, working in security.

prvit 4y ago

rdez6173 4y ago
The only person that made this about the CISOs gender is you. OPs point was about the lack of credentials, which would apply to anyone. I think it's a reasonable conclusion to draw, due to the nature of the very sensitive data at risk. Having professional accreditation that you should be overseeing the security of peoples most sensitive information is objectively a good idea. Muddying the conversation with virtual signaling is more surprising to see on HN.
- johnbellone 4y ago
  They were stating the facts around the Equifax breach which is on topic. What is a surprise is the conversation being derailed because someone wanted to make their comment about gender. It isn’t. https://archive.ph/Afnyl https://archive.ph/Afnyl
- prvit 4y ago
  >The only person that made this about the CISOs gender is you. OPs point was about the lack of credentials, which would apply to anyone. Except it seemingly doesn't apply to literally every other CISO. Does the CISO at Meta have a relevant degree? No. Did Mudge have a relevant degree while he was the CISO at Twitter? No, he also had a music degree. Does Coinbase CISO in charge of securing many billions hold a relevant degree? Nope. Does the CISO at Stripe hold a relevant degree? Again nope. >Having professional accreditation that you should be overseeing the security of peoples most sensitive information is objectively a good idea. It's a good idea, yes! Did some meaningful professional accreditation exist at the time? Nope!
  - thwayunion 4y ago
    The article is about Equifax.
cimi_ 4y ago
I first thought you're right and the joke is not ok - but it's not a joke: https://archive.ph/Afnyl https://archive.ph/Afnyl How is it sexism if it's true? Or should people not bring this up because she's a woman? I think the problem is Equifax's record of handling (non-consenting) user's data, and that causes resentment - not that the CISO was a woman.