Hacker News Reader

Comment by kerng | Hacker News Reader

Alex Stamos is an interesting CISO both Yahoo and Facebook had giant breaches under his tenure and he leaves pretty much right after.

View on HN

According to the article, that's because in both cases they asked him to help in the cover up, and he refused to bend his ethics like that.

But also according to the article, he’s not a very effective manager and difficult to work both for and with. That’s consistent with what I’ve heard in security circles outside of his infosec microcelebrity friends. You do need exceptional people and political skills to be effective in these jobs, and arrogance is a really bad attribute if your job is to influence.

From the article it looked like he told the truth about the attacks at Yahoo and Marissa lied. I’d leave too under those conditions.

Nice knowing that the SEC investigation backs up his story.

As a CISO it was his responsibility to never end up in that situation in the first place.

That is only true if management follows your recommendations. If they decide profit is more important than security, than your job is to mitigate as much risk as possible and detect breaches as quickly as possible. Which he did.

Your most important job is to come up with recommendations that are tenable for the business and to sell the business on them. It’s not easy, but that is the job. Shouting that other people are idiots because you told them to unplug the internet and then blaming them for ignoring you demonstrates a lack of maturity required at that level.

This is a very naive view of information security. The most sophisticated approaches to modern security - either in technical app/net sec or in risk management - begin from the assumption that vulnerabilities exist and will be exploited.

Every security team should be proactively trying to eliminate security vulnerabilities. But they will happen nonetheless, and the mark of truly secure organizations is in the way they respond to such vulnerabilities.

At the CISO level this becomes even more important: a CISO is not only responsible for setting the organizational mandates for security. They are also responsible for being the public face which responds to notable security events.

Well, neither Yahoo's nor FB's security teams have eliminated the gaping security holes in question, from which I conclude that maybe he just isn't as good as his "public face" would imply.

I wouldn't hire a CISO associated with multiple large breaches in the past as CISO for my company... I think there would be better options.

And neither would I, but a lot of people here apparently would, if his "public face" is pretty enough.

From what I have heard from a CISO, they often get the job but not the power or budget. That turns then into a scapegoat if things go wrong. The day job is primarily politics to get some meager resources for security from somewhere and raising awareness.

A CISO's task is thankless. Beyond financial compensation, which is comparatively lower than the "rock star developers" or executives, the CISO does not get thanked for making the product(s) more secure, ensuring security tends to add more dev time and QA steps which makes everyone working on the product feel like things are taking longer.

The CISO is fighting against the mindset of all other managers in the company who just want to "deliver" the features to make their numbers for the quarter (so they can get a bonus or be promoted), and the developers who are required to "cut corners" both in terms of quality and security in order to ship.

Both Yahoo and Facebook have a history of insecurity that dates back far before the arrival of Alex Stamos, who as others have said, is the "fall guy" when the leaders of the organisation prioritise short-term profits/growth over the security of user's data.

The compensation for these roles is VP+ level, way more than rockstar developers.

There's a lot that's uneviable about Stamos's position - his compensation is not one of them.

"Success consists of going from failure to failure without loss of enthusiasm."

-- Winston Churchill

I hope people stop quoting such an awful man responsible for genocide in South Asia. It's a very painful memory for some everytime his name comes up.

Sounds like what some one would do if they got a golden parachute from every failure.

It doesn't take way from the fact that he is right...

Reply on news.ycombinator.com