3 ms·

Doesn't "CSO" come with potential for personal liability in worst-case scenarios? It's not clear if OP volunteered/applied for this security role, or it was th

by ttymck 4y ago

Doesn't "CSO" come with potential for personal liability in worst-case scenarios? It's not clear if OP volunteered/applied for this security role, or it was thrust upon them. If the company isn't wise enough to know they need a CSO, I have to think it's quite risky to jump headfirst into that pool. I also think this advice (the comment I'm replying to) is rather misguided. OP was asking "how do I get better at security". Instructing them to say "I'm the new CSO" seems like a leap. If they knew what being CSO meant, and how to do it, they wouldn't be asking for advice here. But maybe I'm overestimating the "riskiness" of assuming responsibility for the security of BigCo data.

otoburb 4y ago
You've hit the nail on the head to what I believe is the crux of the issue: OP is "jumping headfirst" into a cybersecurity role for a 30 person company with large/important clients without considering what they will need, beyond additional hard skills, to be successful. The background information is enormously helpful because, as you noted, it sounds like this is being thrust upon OP, but one can turn the conversation around and try to discuss what is actually needed to upgrade company security policies, infrastructure and processes -- starting with bandwidth (i.e. time). And carving out that time requires setting and managing expectations with both OP and CEO. Perhaps my wording came across incorrectly, but "interim CSO" doesn't mean vying for a title bump (although that's one power move OP could certainly attempt), but more to bring to the CEO's attention that this role is now important enough at the company's current size that it deserves full-time attention.
hbrn 4y ago
> Doesn't "CSO" come with potential for personal liability in worst-case scenarios? Depends on your definition of worse-case scenario, but generally no. Otherwise no one would be dumb enough to take that job. Personal liability is not impossible of course, here's the recent example that made headlines: https://www.justice.gov/usao-ndca/pr/former-chief-security-officer-uber-convicted-federal-charges-covering-data-breach https://www.justice.gov/usao-ndca/pr/former-chief-security-o... But "obstruction of justice" and "misprision of felony" is not something that just happens to you by accident.

by ttymck 4y ago

otoburb 4y ago

You've hit the nail on the head to what I believe is the crux of the issue: OP is "jumping headfirst" into a cybersecurity role for a 30 person company with large/important clients without considering what they will need, beyond additional hard skills, to be successful. The background information is enormously helpful because, as you noted, it sounds like this is being thrust upon OP, but one can turn the conversation around and try to discuss what is actually needed to upgrade company security policies, infrastructure and processes -- starting with bandwidth (i.e. time). And carving out that time requires setting and managing expectations with both OP and CEO. Perhaps my wording came across incorrectly, but "interim CSO" doesn't mean vying for a title bump (although that's one power move OP could certainly attempt), but more to bring to the CEO's attention that this role is now important enough at the company's current size that it deserves full-time attention.

hbrn 4y ago

> Doesn't "CSO" come with potential for personal liability in worst-case scenarios? Depends on your definition of worse-case scenario, but generally no. Otherwise no one would be dumb enough to take that job. Personal liability is not impossible of course, here's the recent example that made headlines: https://www.justice.gov/usao-ndca/pr/former-chief-security-officer-uber-convicted-federal-charges-covering-data-breach https://www.justice.gov/usao-ndca/pr/former-chief-security-o... But "obstruction of justice" and "misprision of felony" is not something that just happens to you by accident.