3 ms·

I actually think the Target CISO (or CIO maybe) job would be awesome. Target as a company overall is great; they might not be up to standard on IT/IT Security,

by rdl 13y ago

I actually think the Target CISO (or CIO maybe) job would be awesome. Target as a company overall is great; they might not be up to standard on IT/IT Security, but now that the board sees how IT and IT security can affect their bottom line (or indeed existence), whoever takes the role should be able to do amazing things. Plus, it's high visibility when you succeed.

redbeard0x0a 13y ago
> Plus, it's high visibility when you succeed. Actually, no. That is one of the biggest problems with properly functioning IT systems, they become invisible - nobody notices until something screws up...
- rdl 13y ago
  In general, yes, but after a company has gotten fucked as much as Target, it's pretty easy to turn this into a high-profile "we must bring the US payment card industry into the 1980s!" position.
- chaz 13y ago
  I think that's true at smaller organizations where the head of IT isn't on the exec team. But at large companies, the head of IT is a pretty serious role (Jacob was CIO/EVP), with a very large budget, mission-critical systems, and a big team. Someone who successfully runs IT at a company like Target can pretty much get hired into a similar role at any other Fortune 500 company.
rhizome 13y ago
Have you ever worked with POS systems before?
- rdl 13y ago
  Sadly, yes (retrofitting NFC into them, basically the inverse of what Square does, in 2003)
codeonfire 13y ago
CIO to me is just a job that the CEO can cut loose if some disaster happens to save his ass. Nobody needs a CIO around to ponder about IT security. It's something that has to be owned by individual admins and developers. The CIO can dictate strategy or policy or whatever, but its going to be individual mistakes like playing loose with credentials or messing up configuration that lead to data breaches.
- rdl 13y ago
  CIO is a lot more than security. In some companies, CIO is on par with CFO in importance. CISO sort of exists to get thrown under the bus, but in a regulated industry, has a huge compliance role. The whole point of policy is to resource the whole thing adequately so individual mistakes get prevented, or caught and corrected, before they turn into a Target-scale problem. But that usually requires doing more than just bare compliance minimums, and is only possible with board level support for that kind of thing. Probably exists at Target now. Probably didn't before.

by rdl 13y ago

redbeard0x0a 13y ago

> Plus, it's high visibility when you succeed. Actually, no. That is one of the biggest problems with properly functioning IT systems, they become invisible - nobody notices until something screws up...

rdl 13y ago
In general, yes, but after a company has gotten fucked as much as Target, it's pretty easy to turn this into a high-profile "we must bring the US payment card industry into the 1980s!" position.
chaz 13y ago
I think that's true at smaller organizations where the head of IT isn't on the exec team. But at large companies, the head of IT is a pretty serious role (Jacob was CIO/EVP), with a very large budget, mission-critical systems, and a big team. Someone who successfully runs IT at a company like Target can pretty much get hired into a similar role at any other Fortune 500 company.

rhizome 13y ago

Have you ever worked with POS systems before?

rdl 13y ago
Sadly, yes (retrofitting NFC into them, basically the inverse of what Square does, in 2003)

codeonfire 13y ago

CIO to me is just a job that the CEO can cut loose if some disaster happens to save his ass. Nobody needs a CIO around to ponder about IT security. It's something that has to be owned by individual admins and developers. The CIO can dictate strategy or policy or whatever, but its going to be individual mistakes like playing loose with credentials or messing up configuration that lead to data breaches.

rdl 13y ago
CIO is a lot more than security. In some companies, CIO is on par with CFO in importance. CISO sort of exists to get thrown under the bus, but in a regulated industry, has a huge compliance role. The whole point of policy is to resource the whole thing adequately so individual mistakes get prevented, or caught and corrected, before they turn into a Target-scale problem. But that usually requires doing more than just bare compliance minimums, and is only possible with board level support for that kind of thing. Probably exists at Target now. Probably didn't before.