6 ms·

In most public companies, CISOs are not "real" C-level positions. They're not considered "directors and officers" of the company in the sense of the securities

In most public companies, CISOs are not "real" C-level positions. They're not considered "directors and officers" of the company in the sense of the securities law, they don't have special contracts, they don't rake in exorbitant salaries, they don't have golden parachutes. They don't routinely participate in board meetings or shareholder reporting. If I recall correctly, at Apple, the CISO role was some guy reporting to the corp IT org, entirely separate from core products and services. And we're talking about one of the most valuable and sophisticated tech companies in the world. Amazon had an even wackier model, with separate "CISOs" for different orgs, the term meaning not much more than "a senior manager that we can put in touch with clients if needs be." Google now has a "cloud CISO" who is a nice techie guy and talks to customers, but is not actually the person in charge of the overall Google security org. I get it that the SEC wants to change this culture and have a designated person meaningfully responsible for infosec risk, but it feels that it's a case of stick before the carrot. They have the power to reinterpret their own rules to elevate CISOs before they start cracking down on them with personal liability lawsuits. And I'm betting that just like in the case of Uber, the CISO will end up in trouble, while all the execs will get to claim ignorance and walk free.

tptacek 3y ago
Here it's worth remembering that CISO is a "specific" role; it does not necessarily connote "most senior security person in the company"; some companies have more than one; some companies have a "CSO" and/or a chief of "risk"; at Apple (for all I know) it might just mean "most senior security person in IS&T". Apple has a sprawling and multifunctional security team. If your claim is that all of security at Apple somehow reports up through IS&T, I have some reason to believe that is not the case.
- PumpkinSpice 3y ago
  No, the bulk of security and privacy work at Apple happens elsewhere.
  - tptacek 3y ago
    Oh, we're saying the same thing, and I misconstrued you; I thought you were making a comment about how lackadaisical Apple is about security, but you're just saying "CISO" isn't that big a thing. I agree! Sorry about that.
tensor 3y ago
If we're being critical here, I'd also argue that often the CISO's job and main concern is simply making sure they have the right paperwork and motions in place to pass a given set of industry audit standards. These people are not always even capable of understanding the technical security of a product. Paper security like this is often a minimum bar, and sometimes even below minimum when the audit checklists lag best practices like "password rules" requirements did for so long. I agree that if the CISO is liable, they should also actually be responsible, but making the CISO responsible won't by itself fix the industry's security issues.
- PumpkinSpice 3y ago
  The password example feels egregious, but keep in mind that the investigators spent months if not years combing through corporate records and are now showcasing the most embarrassing finds in the framing of their choice. I bet there's not a single company in the world where some engineer didn't at one point set up a dumb password as a part of some one-off integration. The job of the security team is to systematically track down stuff like that, but you never reach 100%. There are things you don't see. What feels particularly weird here is that SolarWinds wasn't compromised by a Bulgarian cybercrime gang. They were compromised by a nation state. While the SEC is notionally focusing on other stuff, this is ultimately the company's original sin. How many businesses, no matter how strong their security posture, can really say that they're immune to that?
  - bawolff 3y ago
    Nation states like anyone else have budgets. No company is immune to the full weight of a major nation state but most of the time that is not brought to bear. You don't need to be impossible to hack, you just need to be hard enough that the value provided is less than the effort required. Still a pretty tall order, but a few steps down from impossible.
    - iamthepieman 3y ago
      Isn't this a "I don't have to be fast, just faster than you" scenario when a bear is chasing you and all your peers? There's always going to be a curve and if anyone on the front side of the bell curve is below the threshold for "worth the effort" then this seems like a useless goal. I agree with other posters that this is more about transparency.
baybal2 3y ago
[dead]
deleted 3y ago
[deleted]
_8j50 3y ago
I don't know security law at all but I have always seen CISO equivalent positions to be "Director" level, reporting typically to the CFO or to A C-level of some org who reports to another C-level and so on depending on size and complexity. But you are right in that they're just regular mid level managers, not directly accountable to the board.
- PumpkinSpice 3y ago
  "Directors and officers" are a special legal category, basically the highest-ranking people making material decisions about the business day-to-day. They are subject to special reporting requirements, such as having to file paperwork whenever selling or buying stock (which usually needs to happen under a trading plan). They often have specialized contracts, company-provided liability insurance, and a variety of perks you associate with "real" executives at public companies - from corporate jets to eight-figure salaries. We're talking about the CEO, CFO, CTO, and so on. This is similarly-sounding but completely separate from the "director" job level at a typical tech company, which is basically just a senior manager of a large team or maybe the lead of a mid-size department. Your average CISO is probably in this ballpark, commonly at least 2-3 reporting levels below real C-leadership.
  - metaphor 3y ago
    This. With respect to SolarWinds, we need only defer to their proxy statement to discover who the real shotcalling directors[1] and executives[2] are. [1] https://www.sec.gov/Archives/edgar/data/1739942/000173994223000040/swi-20230412.htm#i8b2d2cf6caeb42449882d7d969636e4f_13 https://www.sec.gov/Archives/edgar/data/1739942/000173994223... [2] https://www.sec.gov/Archives/edgar/data/1739942/000173994223000040/swi-20230412.htm#i8b2d2cf6caeb42449882d7d969636e4f_109 https://www.sec.gov/Archives/edgar/data/1739942/000173994223...
- browningstreet 3y ago
  The CISOs I've worked with were usually Directors, or VPs, and in 3 cases so far, lawyers who made it into IS/IT management. Their CISO duties/powers were thin. Head-nods and "let's set up a separate meeting for that" level.
tw04 3y ago
>I get it that the SEC wants to change this culture and have a designated person meaningfully responsible for infosec risk, but it feels that it's a case of stick before the carrot. They have that already, it’s the CEO - he is supposed to have ultimate responsibility which is why he (or she) gets obscene compensation. They should be incentivized to hire the best CISO he can find because he’s facing jail time if he doesn’t. Instead he has 0 responsibility because literally everything is an underlings fault.
- girvo 3y ago
  It's somewhat wild: I remember as a kid being taught that those with the power are the ones with the responsibility. And yet once I entered the workforce, it turns out it's the opposite.
  - jpgvm 3y ago
    They do have the responsibility, the responsibility to appoint the appropriate fall guy in accordance with the wishes of the board.
- hnuser9002 3y ago
  While this may be true most of the time, there are cases where the CEO has taken full responsibility. A podcast [1] by Darknet Diaries on a breach in 2015 at mobile provider TalkTalk in the UK tells of such a case. [1] https://open.spotify.com/episode/4fihCSOPKrIDXPB2azNgOc?si=38d3389dda8d470c https://open.spotify.com/episode/4fihCSOPKrIDXPB2azNgOc?si=3...
donmcronald 3y ago
So they're basically a whipping boy?
- ciroduran 3y ago
  P.L.E.A.S.E.
voxic11 3y ago
The problem wasn't that they had bad security and were hacked. The problem is that they lied to investors about their security and about the hack. So if a CISO was the one telling the lies (and you seem to acknowledge that their main purpose is talking to clients, but maybe its also talking to investors) then they seem to be the right person to charge even if they weren't responsible for the bad security.
helsinkiandrew 3y ago
He's being sued for his actions not because of his position - he was responsible for acknowledging the issues internally and not acting on them, he was responsible for the language of statements made to shareholders that misled them about the state of security. If he had sent an email to the CEO saying "we have a problem, we need to do something about this" and the CEO had overruled him, the CEO would be being sued directly. It doesn't really matter what his role or how high up he was - he was found standing over the body holding the smoking gun.

tptacek 3y ago

Here it's worth remembering that CISO is a "specific" role; it does not necessarily connote "most senior security person in the company"; some companies have more than one; some companies have a "CSO" and/or a chief of "risk"; at Apple (for all I know) it might just mean "most senior security person in IS&T". Apple has a sprawling and multifunctional security team. If your claim is that all of security at Apple somehow reports up through IS&T, I have some reason to believe that is not the case.

PumpkinSpice 3y ago
No, the bulk of security and privacy work at Apple happens elsewhere.
- tptacek 3y ago
  Oh, we're saying the same thing, and I misconstrued you; I thought you were making a comment about how lackadaisical Apple is about security, but you're just saying "CISO" isn't that big a thing. I agree! Sorry about that.

tensor 3y ago

If we're being critical here, I'd also argue that often the CISO's job and main concern is simply making sure they have the right paperwork and motions in place to pass a given set of industry audit standards. These people are not always even capable of understanding the technical security of a product. Paper security like this is often a minimum bar, and sometimes even below minimum when the audit checklists lag best practices like "password rules" requirements did for so long. I agree that if the CISO is liable, they should also actually be responsible, but making the CISO responsible won't by itself fix the industry's security issues.

PumpkinSpice 3y ago
The password example feels egregious, but keep in mind that the investigators spent months if not years combing through corporate records and are now showcasing the most embarrassing finds in the framing of their choice. I bet there's not a single company in the world where some engineer didn't at one point set up a dumb password as a part of some one-off integration. The job of the security team is to systematically track down stuff like that, but you never reach 100%. There are things you don't see. What feels particularly weird here is that SolarWinds wasn't compromised by a Bulgarian cybercrime gang. They were compromised by a nation state. While the SEC is notionally focusing on other stuff, this is ultimately the company's original sin. How many businesses, no matter how strong their security posture, can really say that they're immune to that?
- bawolff 3y ago
  Nation states like anyone else have budgets. No company is immune to the full weight of a major nation state but most of the time that is not brought to bear. You don't need to be impossible to hack, you just need to be hard enough that the value provided is less than the effort required. Still a pretty tall order, but a few steps down from impossible.
  - iamthepieman 3y ago
    Isn't this a "I don't have to be fast, just faster than you" scenario when a bear is chasing you and all your peers? There's always going to be a curve and if anyone on the front side of the bell curve is below the threshold for "worth the effort" then this seems like a useless goal. I agree with other posters that this is more about transparency.

baybal2 3y ago

[dead]

deleted 3y ago

[deleted]

_8j50 3y ago

I don't know security law at all but I have always seen CISO equivalent positions to be "Director" level, reporting typically to the CFO or to A C-level of some org who reports to another C-level and so on depending on size and complexity. But you are right in that they're just regular mid level managers, not directly accountable to the board.

PumpkinSpice 3y ago
"Directors and officers" are a special legal category, basically the highest-ranking people making material decisions about the business day-to-day. They are subject to special reporting requirements, such as having to file paperwork whenever selling or buying stock (which usually needs to happen under a trading plan). They often have specialized contracts, company-provided liability insurance, and a variety of perks you associate with "real" executives at public companies - from corporate jets to eight-figure salaries. We're talking about the CEO, CFO, CTO, and so on. This is similarly-sounding but completely separate from the "director" job level at a typical tech company, which is basically just a senior manager of a large team or maybe the lead of a mid-size department. Your average CISO is probably in this ballpark, commonly at least 2-3 reporting levels below real C-leadership.
- metaphor 3y ago
  This. With respect to SolarWinds, we need only defer to their proxy statement to discover who the real shotcalling directors[1] and executives[2] are. [1] https://www.sec.gov/Archives/edgar/data/1739942/000173994223000040/swi-20230412.htm#i8b2d2cf6caeb42449882d7d969636e4f_13 https://www.sec.gov/Archives/edgar/data/1739942/000173994223... [2] https://www.sec.gov/Archives/edgar/data/1739942/000173994223000040/swi-20230412.htm#i8b2d2cf6caeb42449882d7d969636e4f_109 https://www.sec.gov/Archives/edgar/data/1739942/000173994223...
browningstreet 3y ago
The CISOs I've worked with were usually Directors, or VPs, and in 3 cases so far, lawyers who made it into IS/IT management. Their CISO duties/powers were thin. Head-nods and "let's set up a separate meeting for that" level.

tw04 3y ago

>I get it that the SEC wants to change this culture and have a designated person meaningfully responsible for infosec risk, but it feels that it's a case of stick before the carrot. They have that already, it’s the CEO - he is supposed to have ultimate responsibility which is why he (or she) gets obscene compensation. They should be incentivized to hire the best CISO he can find because he’s facing jail time if he doesn’t. Instead he has 0 responsibility because literally everything is an underlings fault.

girvo 3y ago
It's somewhat wild: I remember as a kid being taught that those with the power are the ones with the responsibility. And yet once I entered the workforce, it turns out it's the opposite.
- jpgvm 3y ago
  They do have the responsibility, the responsibility to appoint the appropriate fall guy in accordance with the wishes of the board.
hnuser9002 3y ago
While this may be true most of the time, there are cases where the CEO has taken full responsibility. A podcast [1] by Darknet Diaries on a breach in 2015 at mobile provider TalkTalk in the UK tells of such a case. [1] https://open.spotify.com/episode/4fihCSOPKrIDXPB2azNgOc?si=38d3389dda8d470c https://open.spotify.com/episode/4fihCSOPKrIDXPB2azNgOc?si=3...

donmcronald 3y ago

So they're basically a whipping boy?

ciroduran 3y ago
P.L.E.A.S.E.

voxic11 3y ago

The problem wasn't that they had bad security and were hacked. The problem is that they lied to investors about their security and about the hack. So if a CISO was the one telling the lies (and you seem to acknowledge that their main purpose is talking to clients, but maybe its also talking to investors) then they seem to be the right person to charge even if they weren't responsible for the bad security.

helsinkiandrew 3y ago

He's being sued for his actions not because of his position - he was responsible for acknowledging the issues internally and not acting on them, he was responsible for the language of statements made to shareholders that misled them about the state of security. If he had sent an email to the CEO saying "we have a problem, we need to do something about this" and the CEO had overruled him, the CEO would be being sued directly. It doesn't really matter what his role or how high up he was - he was found standing over the body holding the smoking gun.