I'm still astounded no one ended up in jail over that. Software Engineering really does need some professionalization.
Consequences is what it needs. We can no longer allow it to be profitable to be so brazenly irresponsible.
External selection pressure to kill off the maladaptive traits.
I'm struggling to understand what the point of this was.
You’d be surprised how incompetent an auditor can be if the security framework simply requires them to blindly fill in responses on boilerplate spreadsheets based on the department’s word alone.
For example, risk assessments are performed for all new applications requested by employees. InfoSec: Does this COTS web application have X security control which protects data in transit via encryption acceptable for use in our operating environment?
Some bozo from marketing: Yeah, I’m pretty sure.
In truth, neither of them are sure. The requester didn’t check, and the auditor saw the word “encryption” on the vendor’s website along with a green padlock in the address bar and that was good enough.
The auditor doesn’t even know how check the ciphers being used for this sketchy web application. The control also requires TLS 1.2+ due to the sensitive nature of the data. The auditor marks the security control as “Met” and approves the software request.
The auditor is completely incompetent, but is used as a pawn in an elaborate game of “security theater” to abstract away liability.
Also, even if the hypothetical security control in the example above wasn’t met, the head of marketing (System Owner) could request an exception be created to skip that security control.
Wait, qzx_pierri, you’re telling me that the security control can be skipped? How the hell is that a security CONTROL?
I don’t know, and that’s why I quit that depressing industry. To everyone reading this: Stay paranoid, and protect your data yourself if it’s on someone else’s server. "Security" (in America, at least) is often complete bullshit.
The person had no relevant degree (as is the case for most people working in security roles, because such degrees didn't exist until very recently).
The person did have a literal decades of relevant experience, working in security.
In this case they happen to be female.
That doesn't mean the criticism is motivated by gender.
Your gender also doesn't excuse you from criticism.
It's hard to get a formal degree on a subject which isn't taught anywhere!
For example: HN loves Mudge, who also happened to just leave a CISO post, and also only holds a music degree from Berkelee.
They were criticised too.
I guess we all see the world as we wish.
Compsci is not an infosec-related degree.
I'll agree the criticism isn't valid.
I disagree about the invalid criticism being gender biased or motivated.
The subject just happens to be female. That doesn't exempt them from valid or invalid criticism.
This isn't difficult really.
The vast majority of the people who invented, built, and maintain all the systems infosec people are deploying had CS or CE degrees. A good CS degree provides an excellent foundation for infosec careers. In fact, at many institutions, the infosec major is very similar to the CS major.
It's not everything you need, which is why a CISO should minimally also spend some time as an individual contributor in an infosec or closely adjacent group.
You're moving the goalposts because your position that CISOs need no education whatsoever in the work they are leading is prime facie absurd.
That's not to say that a CS graduate is or isn't the ideal candidate for the program (I think he felt that they were). But securing systems and organizations is primarily not a technical problem. You should understand that and understand the reasons why.
Sure, but the best security programs don't even exist in the same department as CS.
At CMU Information Security is run by the College of Engineering, not by the CS department.
At NYU Cybersecurity is run by Tandon school of Engineering, not by the CS department.
At RIT Computing Security is run by ... the Department of Computing Security.
At JHU Cybersecurity is run by Whiting School of Engineering, not by the CS department.
This is because computer science and computer security are two entirely different disciplines.
> It's a nasty sexist lie.
LMAO It is literally true.
It is also true AFAIK that when she got her first role as an executive in charge of security, she had no formal training or IC experience in security. All of her "security" experience was in executive roles. Which is insane. That never happens with other types of technical leadership roles (legal, law, finance, accounting, engineering, etc.).
Yes, but that's also true of almost all BigCo CISOs.
>It is also true AFAIK that when she got her first role as an executive in charge of security
By "AFAIK" you mean that this is just what you assume without checking, right?
Yes, we've been over this. The article is about Equifax. I made a comment about Equifax. I've previously criticized other execs after data breaches or other major technical failures (Eg Boeing).
> By "AFAIK" you mean that this is just what you assume without checking, right?
No, it means I did check and she does not according to any publicly available evidence. I added the AFAIK because I cannot personally certify that her publicly available resumes are complete.
It would be extremely odd to exclude relevant work experience from public profiles, so I strongly believe that she does not have relevant experience outside of exec positions (which she shouldn't have had in the first place without IC experience and/or relevant education). But I do not personally know her so I cannot personally attest that her public resumes are complete. Therefore, I added a qualifier.
I can understand why this wording confuses you, though. It's a result of the fact that I have personal integrity and take words and accusations seriously.
People who wield power over IC's but themselves have never been an IC are more willing to make decisions that harm others, but not themselves.
And this is the crux of the issue with the security industry. Too many of their decisions are made in a vacuum and everyone else has to deal with it.
I bet you don't have similar concerns about the educational backgrounds of male CISOs. What relevant degrees do you think Meta's CISO holds? (Hint: none, as is the case for most people in this industry)
Turns out Susan Maudin at Equifax had decades of relevant experience:
* Senior Director of Information Security, Audit and Compliance at HP
* Senior Vice President and Chief Security Officer and First Data Corporation
* Group Vice President Sun Trust Bank
I think it's a reasonable conclusion to draw, due to the nature of the very sensitive data at risk.
Having professional accreditation that you should be overseeing the security of peoples most sensitive information is objectively a good idea.
Muddying the conversation with virtual signaling is more surprising to see on HN.
Except it seemingly doesn't apply to literally every other CISO. Does the CISO at Meta have a relevant degree? No. Did Mudge have a relevant degree while he was the CISO at Twitter? No, he also had a music degree. Does Coinbase CISO in charge of securing many billions hold a relevant degree? Nope. Does the CISO at Stripe hold a relevant degree? Again nope.
>Having professional accreditation that you should be overseeing the security of peoples most sensitive information is objectively a good idea.
It's a good idea, yes! Did some meaningful professional accreditation exist at the time? Nope!
How is it sexism if it's true? Or should people not bring this up because she's a woman?
I think the problem is Equifax's record of handling (non-consenting) user's data, and that causes resentment - not that the CISO was a woman.
Nobody would ever bring this up about a man, most CISOs have similar degrees. You haven't even been able to get a formal education on this topic for very long.
I'm sick of MBAs with no domain expertise or formal training ruining lives. Making that about gender is insane.
She was incompetent and should be in jail.
I haven't heard anyone saying that about Metas CISO, or Twitters CISO, or Ubers CISO.
For example, the data leaked from Uber in the recent breach is way more impactful than anything which ever leaked from Equifax.
But hey, maybe that's just because nobody noticed that Latha Maripuri is also a woman.
>She was incompetent and should be in jail.
How would you know it wasn't her superiors constantly blocking her from doing her job properly?
What could be more impactful than the social security numbers, personal information, and financial records of every adult in the US?
>But hey, maybe that's just because nobody noticed that Latha Maripuri is also a woman.
Yes, that should tell you that gender has nothing to do with it which you are vehemently trying to make this about.
>How would you know it wasn't her superiors constantly blocking her from doing her job properly?
I don't know that, that's why the company should have been liquidated as compensation, or at the very least it should have been taken to court where she can testify to what she tried to do and what she was blocked from doing. Otherwise, the responsibility lies with her -- that is literally her job description.
You could already buy just about any adults SSN for a dollar from various breach aggregators well before the equifax leak, so literally nothing changed in that regard.
Personal information? What? Names, addresses, dates of birth? The above still applies.
Uber holds very detailed location data, travel histories. Far more revealing than what might have come
>Yes, that should tell you that gender has nothing to do with it which you are vehemently trying to make this about.
I'm not sure you can seriously read anything into that, it's essentially random whether or not these things get picked up.
Or why do you think that Susan Mauldin is widely ridiculed but Latha Maripuri is not? Both have very similar resumes, no formal qualifications and presided over massive breaches.
>I don't know that, that's why the company should have been liquidated as compensation, or at the very least it should have been taken to court where she can testify to what she tried to do and what she was blocked from doing. Otherwise, the responsibility lies with her -- that is literally her job description.
This doesn't make any sense. You don't know and the possible actual culprits did not tell you otherwise, so the responsibility lies with her?
Not only is this entirely speculative and needs a citation, just because others have experienced breaches doesn't mean you get to publicize private information, that once again, people did not consent to because they're not users or customers of Equifax.
>You don't know and the possible actual culprits did not tell you otherwise, so the responsibility lies with her?
Yes, that is the role of a Chief Information Security Officer. Here is a brief description for your reference:
>The CISO (chief information security officer) is a senior-level executive responsible for developing and implementing an information security program, which includes procedures and policies designed to protect enterprise communications, systems and assets from both internal and external threats.
Unless other information comes out to suggest otherwise, yes, it is very fair to assume the responsibility lies with her.
https://krebsonsecurity.com/2013/09/data-broker-giants-hacke...
From 2013, but this stuff has been out on all the crime forums since early 2000s.
SSN leaks have not mattered for a long time.
People in technical leadership roles should have formal training and should have spent some time in the trenches, full stop. We hold most other specialized leadership roles to this standard: Chief Financial Officers, Chief Legal Officers, Chief Medical Officers, etc. Why not CTOs and CISOs?
> nasty sexism... male CISO at other company...
The article is about Equifax. I am commenting about Equifax. This is not about gender.
I'm well aware that this problem is pervasive in American business culture. The article is about Equifax. So I am commenting about Equifax.
> Turns out Susan Maudin at Equifax had decades of relevant experience:
Those are all also management roles. She went from non-cybersecurity into cybersecurity management and then worked her way up the management chain.
She had no formal training in IT/CS, no experience as an IC in IT/CS, and her organization royally screwed up.
Expecting relevant formal education and relevant IC experience is not sexist.
The vast majority of qualified candidates will not have relevant formal training. Until very recently it's been borderline impossible to get an infosec degree, and what little opportunities existed were of atrocious quality.
>Oh, please. I'm well aware that this problem is pervasive in American business culture. The article is about Equifax. I am commenting about Equifax.
1) It's not a problem
2) It's not American
This is just how emerging fields are, you can't have formal education when nobody knows what to teach.
You will never convince me that Equifax could not have hired a CISO with decades of relevant IC and leadership experience and appropriate educational background. Perhaps Maudin at the time she was hired, I'm not sure the length of her tenure. But there was certainly no excuse for choosing an MBA without IC cybersecurity experience for her replacement. (Who, btw, is a man and also wildly unqualified except for a string of other executive positions that he also should not have been in... happy now?)
>> The article is about Equifax. I am commenting about Equifax.
> 1) It's not a problem
You have got to be kidding me.
1. Equifax majorly shit the bed on cybersecurity, and the buck stops at the CISO.
2. Why is this not the case for CFOs, CMOs, CLOs, and literally every other technical chief officer position except CTOs and CISOs? Again, it's not the 90s.
If it's so easy, surely you can name a couple of people with decades of relevant IC and leadership experience and appropriate educational background who they could have hired back when they went with Maudin?
>1. Equifax majorly shit the bed on cybersecurity, and the buck stops at the CISO.
The buck never stops at the CISO, just like it supposedly didn't at Twitter.
Yes, I can name dozens of people who would have made excellent CISOs in 2017 and meet my (low) bar of (1) relevant IC experience and (2) some relevant formal training.
> The buck never stops at the CISO, just like it supposedly didn't at Twitter.
If the buck doesn't stop there, it certainly passes through.
Let me flip this around: should you hire a Software Engineer with decades of management experience at a bank to the Chief Financial Officer? What about lawyer who's worked at a hospital to be the Chief Medical Officer? Would you hire an MBA without any legal experience to be your Chief Legal Officer? No, no, and no. If a company did any of those things and shit hit the fan, people would be irate and the company would be rightly criticized.
So why is it okay to fill CTO and CISO roles with MBAs who have no technical training or experience?
It's not, and I don't think juries are going to put up with this over the next couple decades. The "new field" argument is increasingly implausible.
I'm sure it's easy to find lots of qualified people with compsci degrees, but that's not a relevant degree.
My current employer's CISO or my former employer's equivalent of the CISO. Both were hired prior to 2017 and had relevant education and expertise. And no, I'm not going to risk doxing myself to someone accusing me of sexism for saying that CTO/CISO roles should be filled by people with relevant education.
> Compsci is not an infosec-related degree.
Are you kidding me? I am beginning to lose confidence in any ability to have a reasonable conversation with you.
Four years of CS cover a lot of material that is directly relevant to information security, even without any formal coursework in security. Most CS degrees require several years of programming, an Operating Systems course, and courses like Networking, Cybersecurity, and Cryptography are often offered as electives. Even the basic courses offer a lot of basic knowledge about the work being managed.
Is it everything you need? No, of course not! That's why the criteria -- from my first post -- is BOTH relevant education and also relevant IC experience.
What is inappropriate is a CISO who has never written or read a single line of code, never configured a piece of IT equipment, etc. It would be like a CLO who has never read a legal brief or a chief medical officer who has never treated a patient. They won't even have a basic high-level understanding of what's actually going on in the work they are managing. I've seen this, first hand, from a (male) executive who did not have a technical background.
I took courses on Cryptography, Networking (with a unit on DoS/DDoS mitigation), Operating Systems (with a TON of systems programming that got me intimately familiar with buffer overflows and memory models), and a Software Engineering course that included some discussion of injection attacks.
As term or course projects I implemented or was part of team that implemented: a virus scanner, an intrusion detection system (back before they were common -- we called in 'dynamic iptables' or something like that), portions of an operating system with a bunch of security and permissions relevant stuff, a password cracker, and a bunch of crypto algorithms.
Aside from all of this, a basic understanding of how to program and build software systems is already important background.
But no CS is totally unrelated to infosec and I'm a sexist dick for saying that people in leadership should know about the work they are managing. /s
Sounds to me like the execs just have control issues. "WE get to fly around in the private jets and strike business deals on the golf course, not you!"
Criminally negligent executives, in my personal opinion.
Execs hired incompetent (or maybe just "profit oriented") management and that incompetence trickled down to the bottom.
They are big enough it's totally normal that not everyone knows what everyone else is doing.
Not sure what the leak is telling you, it's not telling me too much
“Distracted” like the time that Equifax leaked hundreds of millions of pieces of personal data. Maybe instead of blaming the workforce they should worry about making the company a place that people want to work exclusively. Equifax does not matter at all as an organization.