3 ms·

Or should the CISO be an employee of a federal agency? Edit: wish folks downvoting this would comment too. We're supposed to be curious here.

ethbr0 3y ago
For systemically-important tech firms? There should definitely be a government inspector general empowered to poke around. SolarWinds was a sophisticated operation, but there are a ton of security orgs for very important companies that are just inept, underfunded, or both. And absent mandated ability to inspect, they're not going to get the harsh spotlight of "unfuck this now" they deserve.
3np 3y ago
I don't think that the PRC is a role-model here.
halJordan 3y ago
Comments like these implicitly deny the existence of heavily regulated industries. When refusal to take cybersecurity seriously results in 1/3 of Americans losing their identity or when refusal to take cybersecurity seriously results in what happened to solarwinds they should be subjected to a regulatory scheme that will enforce seriousness.
- candiddevmike 3y ago
  If you think "regulated industries" have great security, I have a bridge to sell you. Regulations are just more checkboxes for most businesses.
  - miguelazo 3y ago
    Agreed, but this is in large part a function of how things are enforced. The lack of real accountability (especially at the executive level) related to the spirit of the law/regulations is how these things just turn into box ticking exercises.
  - halJordan 3y ago
    If you think those checkboxes aren't actively serving a purpose then ... there's nothing really to say against such ignorance except to inform you youry wrong.
- neilv 3y ago
  > When refusal to take cybersecurity seriously results in 1/3 of Americans losing their identity Part of the problem is that the term "identity theft" itself is spin to avoid addressing security problems. As brilliantly pointed out by Mitchell & Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
  - halJordan 3y ago
    As far as societal problems go by far the biggest is the need for people to only consume entertainment because then they start using it as an argument. It was funny enough when people were using Jon Stewart. It was bad enough when people started using John Oliver. But Mitchell and Webb? Really? Identity theft is not a joke Jim.
    - neilv 3y ago
      I used that The Office reference a few days ago. The BBC period costume drama image of posh characters referencing the classics makes that look more respectable, but I'm not sure how different was that in practice to the modern day, say, barrage of obvious reaction "meme" images to a Tweet. As the poet said, "Hasta la vista, baby."
- tbrownaw 3y ago
  > results in 1/3 of Americans losing their identity Just because enough identifying information about me had been leaked where people could potentially use it to impersonate me, does not mean that I stop knowing who I am.
morpheuskafka 3y ago
Typically the company would always have its own in-house compliance organization and executive, even if there is extensive, on-site federal regulation (like banking sector). So that would probably look like the company having its own CISO, but some of the technical decisions/changes being approved by or required by a regulatory agency.

ethbr0 3y ago

For systemically-important tech firms? There should definitely be a government inspector general empowered to poke around. SolarWinds was a sophisticated operation, but there are a ton of security orgs for very important companies that are just inept, underfunded, or both. And absent mandated ability to inspect, they're not going to get the harsh spotlight of "unfuck this now" they deserve.

3np 3y ago

I don't think that the PRC is a role-model here.

halJordan 3y ago

Comments like these implicitly deny the existence of heavily regulated industries. When refusal to take cybersecurity seriously results in 1/3 of Americans losing their identity or when refusal to take cybersecurity seriously results in what happened to solarwinds they should be subjected to a regulatory scheme that will enforce seriousness.

candiddevmike 3y ago
If you think "regulated industries" have great security, I have a bridge to sell you. Regulations are just more checkboxes for most businesses.
- miguelazo 3y ago
  Agreed, but this is in large part a function of how things are enforced. The lack of real accountability (especially at the executive level) related to the spirit of the law/regulations is how these things just turn into box ticking exercises.
- halJordan 3y ago
  If you think those checkboxes aren't actively serving a purpose then ... there's nothing really to say against such ignorance except to inform you youry wrong.
neilv 3y ago
> When refusal to take cybersecurity seriously results in 1/3 of Americans losing their identity Part of the problem is that the term "identity theft" itself is spin to avoid addressing security problems. As brilliantly pointed out by Mitchell & Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
- halJordan 3y ago
  As far as societal problems go by far the biggest is the need for people to only consume entertainment because then they start using it as an argument. It was funny enough when people were using Jon Stewart. It was bad enough when people started using John Oliver. But Mitchell and Webb? Really? Identity theft is not a joke Jim.
  - neilv 3y ago
    I used that The Office reference a few days ago. The BBC period costume drama image of posh characters referencing the classics makes that look more respectable, but I'm not sure how different was that in practice to the modern day, say, barrage of obvious reaction "meme" images to a Tweet. As the poet said, "Hasta la vista, baby."
tbrownaw 3y ago
> results in 1/3 of Americans losing their identity Just because enough identifying information about me had been leaked where people could potentially use it to impersonate me, does not mean that I stop knowing who I am.

morpheuskafka 3y ago

Typically the company would always have its own in-house compliance organization and executive, even if there is extensive, on-site federal regulation (like banking sector). So that would probably look like the company having its own CISO, but some of the technical decisions/changes being approved by or required by a regulatory agency.