4 ms·
The more these happen, the more likely it'll be that the role of CISO will need to be compensated commensurate to risk. And report up to the CEO. But it also
by eganist 3y ago
The more these happen, the more likely it'll be that the role of CISO will need to be compensated commensurate to risk.
And report up to the CEO.
But it also depends on the nature of the action that's about to come down. My guess is something to do with misrepresentation of Solarwinds' security posture.
- toomuchtodo 3y agoCISO needs to report to either chief risk officer (edit: who reports to the board) or the board directly imho. Anyone else (CXO) has incentive to apply pressure at odds with the role, or not take compliance requirements or regimes seriously. Checks and balances. @dvt: you can nudge with legislation (or in this case, executive branch rule making), we’re just at the initial phase of getting there: https://www.axios.com/2023/04/07/company-boards-sec-cybersecurity https://www.axios.com/2023/04/07/company-boards-sec-cybersec... | https://www.sec.gov/news/press-release/2022-39 https://www.sec.gov/news/press-release/2022-39 | https://www.forbes.com/sites/bobzukis/2022/04/18/the-sec-is-about-to-force-cisos-into-americas-boardrooms/ https://www.forbes.com/sites/bobzukis/2022/04/18/the-sec-is-... Statute and rule making, like corporate bylaws, are mutable, and must adapt to the risk landscape. (thoughts and opinions my own, interim deputy CISO in finance)
- eganist 3y agoWho would the CRO report to?
- dvt 3y ago> CISO needs to report to either chief risk officer (edit: who reports to the board) or the board directly imho. I mean, this is all company bylaws, you can't seriously legislate this. But in any case, C-execs do have skin in the game (particularly if investigated by the SEC). They're usually insulated, but if non-compliant (or grossly negligent), directors can be personally liable.
- CPLX 3y agoYou could legislate that if you wanted to.
- kortilla 3y agoDon’t @ people down thread of you. It makes for a really shitty reading experience
- candiddevmike 3y agoOr should the CISO be an employee of a federal agency? Edit: wish folks downvoting this would comment too. We're supposed to be curious here.
- ethbr0 3y agoFor systemically-important tech firms? There should definitely be a government inspector general empowered to poke around. SolarWinds was a sophisticated operation, but there are a ton of security orgs for very important companies that are just inept, underfunded, or both. And absent mandated ability to inspect, they're not going to get the harsh spotlight of "unfuck this now" they deserve.
- 3np 3y agoI don't think that the PRC is a role-model here.
- halJordan 3y agoComments like these implicitly deny the existence of heavily regulated industries. When refusal to take cybersecurity seriously results in 1/3 of Americans losing their identity or when refusal to take cybersecurity seriously results in what happened to solarwinds they should be subjected to a regulatory scheme that will enforce seriousness.
- candiddevmike 3y agoIf you think "regulated industries" have great security, I have a bridge to sell you. Regulations are just more checkboxes for most businesses.
- miguelazo 3y agoAgreed, but this is in large part a function of how things are enforced. The lack of real accountability (especially at the executive level) related to the spirit of the law/regulations is how these things just turn into box ticking exercises.
- 3y ago
- GartzenDeHaes 3y agoCISO's are often hired for the purpose of having an executive head to cut. They'll commonly report to the CIO, but have c-suite titles or employee designations (at-will in some states). It's a stressful position with a lot of legal responsibility and little organizational influence and authority.