Hacker News Reader

Comment by ummonk | Hacker News Reader

https://www.linkedin.com/in/michael-johnson-098437117/

They hired a bureaucrat, not an engineer, to be their CISO.

Hiring an engineer (and by that I assume you mean someone who has the bulk of their experience as a software engineer) as CISO is exactly the opposite of what a company should do. Security is absolutely not the same skill set as software engineering, and it's a huge misconception that people equate infosec with programming. Security engineers of course should be programmers, but an enormous amount of work that goes into infosec has absolutely nothing to do with code, and this is especially true for someone high up in management ranks like a CISO where their entire job is dealing with bureaucracy.

Hiring an engineer to be a CISO would be like choosing a biologist to give you surgery instead of a surgeon. Yes, a biologist probably knows a lot about the nitty-gritty of how bodies work, but knowing how the body works and knowing how to perform surgery on a body are two very, very different things.

That guy's LinkedIn looks more than qualified to be a CISO, and is certainly more qualified than the vast majority of CISOs I worked with in my career as a security consultant. And on top of all that, he has a degree in computer engineering and has prior experience as an engineer, so I have no idea why you're claiming he isn't an engineer.

I see where you’re coming from but this is not far off the thinking that “an MBA can manage anything”.

To use your analogy no surgeon is allowed to cut until he or she does have a solid grounding in biology.

You're right, that wasn't a very good analogy. My point is not to say that a CISO/surgeon shouldn't have any experience in engineering/biology (in fact, as you pointed out, it is the opposite! you ideally want a CISO with some technical chops just as you want a surgeon with some biology knowledge). My point is that there is much more to being a CISO than just technical knowledge.

Maybe a better analogy would be choosing someone to represent you in a lawsuit about programming patents. You would want a lawyer representing you, not a programmer. Ideally the lawyer would have some previous experience with these kinds of cases and would lean on programming experts for their knowledge. Maybe they are even a former programmer turned lawyer! But I certainly wouldn't hire "a programmer" to represent me no matter how experienced in programming they are. Linus Torvalds would be a great expert witness, but he isn't going to be my general counsel.

I would say the lawsuit example isn't great, lawyer is a specialized profession unto itself. Management has it's own vagaries, but I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering and that was the original point. Having someone with no background in engineering running a department is suspect.

There's still a disconnect here. Infosec is a specialized profession unto itself, too. A CISO is not just "an engineer that's gone into management". My original point is that security is so far removed from "engineering" that it's incorrect to equate the two (even though it's done all the time).

>I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering

IME, it's the opposite. It depends on your specific goal (are we trying to train someone to be CISO or are we training them to be a SOC team leader?), but it's ridiculously easier (and more effective) to take a person with existing management abilities and teach them about security than it is to take an engineer and teach them security management skills.

>Having someone with no background in engineering running a department is suspect.

It's really not, because again, engineering != security. It's no more suspect than the CFO not having a background in engineering.

To use your analogy no surgeon is allowed to cut until he or she does have a solid grounding in biology.

I take it you're unfamiliar with the content of the MCAT exam, which is a prerequisite to admission to American medical schools.

It's difficult because the CISO runs the budget, and a non-technical CISO, in my experience, is much more likely to buy products and not hire people needed to use them.

Think about it this way: publications are telling you that ~92% of Cyber attacks start from an end users device. Probably true, but are we talking about a device being owned here or just are we discussing actual PII data loss?

More importantly, whilst Gartner and co is telling you what products you need to buy to defend against this, what they aren't telling you is the best product only has a 52% attack detection rate. And this only accounts for known attack vectors.

So you're a CISO, you're 15 million down on products, 5 million down on risk people, without a Software Developer, Sysadmin or Release Engineer on your team. The actual Engineering team ignores you because you keep raising stupid concerns.

Would this have happened if you were technical? Maybe, you'd have a different set of problems.

not sure a biologist knows more about the body than a surgeon. isn't it more like asking a surgeon to run the department?

Sounds like they hired a CISO with a toxic personality more interested in internal PR than security, and all the talent ran off. Sounds like this is the exact opposite of what any company should do.

This is an extreme manipulation of the facts. He has an M.Sc in Computer Science, did R&D at Hewlett-Packard during their golden age, and then spent 22 years at Sandia.

This guy was only a bureaucrat in the thinnest interpretation of the word.

He worked at Sandia so he seems to have engineering chops. But it is ridiculous to think that one individual or even one isolated group can defend against pervasive threats. Like worker safety, it has to be a cultural priority starting at the top and made priority #1 in every decision and work process.

Even then, security is an illusion. Eventually something or someone will find a way to get through. Zero trust needs to be embraced. Assume every employee, partner, developer and vendor is going to have full internal access and abuse it...then defend from there.

What according to you is a qualification to be a CISO, of a bank or a financial institution?

I would any day put my money in a bank who has a CISO with such credentials as that of Michael Johnson. He has been an engineer, done R&D, does have the right chops too I guess. And CyberSec has multiple layers - mostly the people, which is the weakest one. And that, my friend, cannot really be solved just by tech.

Whatever he was, if the article is to be believed, it seems like his poor management caused the problem. I believe it. This is often the case, where managers actively interfere with priorities that the engineers try to provide. Not only that but he was using resources to play politics.

The issue is that fundamentally that's what managers and executives do. Their profession is politicking and manipulation rather than solving problems.

Wasn’t that the same at Equifax?

https://www.marketwatch.com/story/equifax-ceo-hired-a-music-...

Sounds like they hired an Olympian

Reply on news.ycombinator.com