We have two primary camps in 2024. Those who believe it is dangerous to hold CISOs accountable for poor security practices and those who think it’s about damn time. I am of the latter mindset. To hold security leaders responsible, we need to allow them to be effective.
On October 30th of last year, 20203, The Securities and Exchange Commission announced charges against Austin, Texas-based software company SolarWinds Corporation and its chief information secIn 2024, the debate about whether CISOs should be held accountable for poor security practices is still ongoing. There are two primary camps – those who believe it’s dangerous and those who think it’s about time. I firmly belong to the latter group. To hold security leaders responsible, we must allow them to be effective. Last year, SolarWinds Corporation and its chief information security officer, Timothy G. Brown, were charged by the Securities and Exchange Commission for fraud and internal control failures relating to known cybersecurity risks and vulnerabilities. The complaint alleges that SolarWinds and Brown defrauded investors by overstating SolarWinds’ cybersecurity practices and understating known risks. During this time, SolarWinds misled investors by only disclosing generic and hypothetical dangers while knowing of specific deficiencies in their cybersecurity practices and the increasing risks they faced.
The SolarWinds situation should not only serve as a cautionary tale but also become a catalyst for effective change. The “House of Blame” approach to security is unacceptable. We need to empower our security and risk leaders to effect positive change instead of pointing fingers in times of crisis. By holding our CISOs accountable and allowing them to be effective, we can create a culture of security that benefits everyone.
Uncategorized
We, are the enemy…..
cybersecurity, security, technology, UncategorizedEDIT: Much has changed from 2016 and yet, remains the same. While this was originally written in response to the Snapchat employee breach we can see continued successful attacks against organizations utilizing basic attack vectors and failings to human error.
I’m often asked as a Cybersecurity, Governance, and Risk Management expert….what keeps you up at night?
It’s people, it’s always been, people.
Properly deployed technology doesn’t need a vacation, come to work feeling awful due to being sick or a severe cold impeding performance. Your cloud deployments, brick-and-mortar approach to a firewall, IDS/IPS, and router deployments that you spend millions on mean zero and zilch if Joe Smiley in supply is not security-aware and educated enough not to open and or respond to a phishing email as an example.
People ultimately are the cause of many and most breaches. Lack of effort and lack of performance. We design and implement the process and procedures. We deploy the technology.
We have met the enemy and he is us.
Security Awareness isn’t cutting edge nor is it sexy for many security professionals and it continues to lag behind the effort placed into the latest widget. Security Awareness goes a long way in establishing a long-held theory on my part that an Information Security department of 40 could quickly become a virtual department of 40k strong ……with the right training and the right incentive.
GreenSecurity 