36 ms·
I am going bet a pillow case of slightly squished mini candy bars that Tim Brown might have been a good technologist, but that he might have been told to sit do
by WaitWaitWha 3y ago
I am going bet a pillow case of slightly squished mini candy bars that Tim Brown might have been a good technologist, but that he might have been told to sit down and color.
I am saying this because reading the interview notes:
> BROWN: It was crazy. So our CEO got a call in the morning from [Mandiant CEO] Kevin Mandia. And then he called me, and then the CTO for FireEye called me. That’s our nightmare moment. [Oct. 26, 2021 Cybersecurity Dive]
Was the Mandiant CEO friends with Solarwinds CEO, to make the call to the CEO instead of the person that (presumably) signed their vendor contract, the CISO?
> SolarWinds did almost immediately was create a cyber-specific committee on your board
I read this as "there was no one, not even the CIO at the board."
If you are a CISO, and you are have to decide between your livelihood for the rest of your life guaranteed by a company, or your livelihood for the rest of your life taken by regulators, where do you go?
If the CISO says to the Corp "no, I am going public/won't lie/[insert insubordination]", no one will hire them thereafter.
If the CISO says "okay, let me sit and color", go to jail, and no one will hire them thereafter.
- wglb 3y agoThose latter two statements are no doubt about why Alex Stamos called being the CSO "the worst job in the world"
- Aerroon 3y agoWho holds the CSO-equivalent job in the government? It's the president or prime minister, isn't it? Because ultimately all decisions have an impact on security.
- WaitWaitWha 3y agoCISO =/= CSO. The Federal Chief Information Security Officer, through the OMB is Chris DeRusha.
- hn_throwaway_99 3y agoYeah, I think you really hit the nail on the head with this one. I want folks to be held accountable, but considering the forces/incentives at play, I worry what you're left with is a CISO role that no sane person would take, so instead it's just taken by grifters who take the "gambling" route - let's just hope the chance that some major breach happens doesn't do so on my watch, but if it's "damned if I do, damned if I don't", might as well collect a fat paycheck while I see what happens.
- pm90 3y agohe could have resigned
- hn_throwaway_99 3y agoExactly my point - if he resigned quietly, the company would hire a "yes man" that exactly fits the profile I described. If he resigned loudly, he probably would be pretty unhireable, at least as another CISO. In neither case do the customers at any company get the benefit of actual improved security.
- asah 3y agonah - SolarWinds was known bad stuff, and easily explained to the next employer.