Hacker News Reader

Comment by goatinaboat | Hacker News Reader

I see where you’re coming from but this is not far off the thinking that “an MBA can manage anything”.

To use your analogy no surgeon is allowed to cut until he or she does have a solid grounding in biology.

You're right, that wasn't a very good analogy. My point is not to say that a CISO/surgeon shouldn't have any experience in engineering/biology (in fact, as you pointed out, it is the opposite! you ideally want a CISO with some technical chops just as you want a surgeon with some biology knowledge). My point is that there is much more to being a CISO than just technical knowledge.

Maybe a better analogy would be choosing someone to represent you in a lawsuit about programming patents. You would want a lawyer representing you, not a programmer. Ideally the lawyer would have some previous experience with these kinds of cases and would lean on programming experts for their knowledge. Maybe they are even a former programmer turned lawyer! But I certainly wouldn't hire "a programmer" to represent me no matter how experienced in programming they are. Linus Torvalds would be a great expert witness, but he isn't going to be my general counsel.

I would say the lawsuit example isn't great, lawyer is a specialized profession unto itself. Management has it's own vagaries, but I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering and that was the original point. Having someone with no background in engineering running a department is suspect.

There's still a disconnect here. Infosec is a specialized profession unto itself, too. A CISO is not just "an engineer that's gone into management". My original point is that security is so far removed from "engineering" that it's incorrect to equate the two (even though it's done all the time).

>I think it's easier for the right kind of engineer to get into management rather than a lifelong manager to gain competence in engineering

IME, it's the opposite. It depends on your specific goal (are we trying to train someone to be CISO or are we training them to be a SOC team leader?), but it's ridiculously easier (and more effective) to take a person with existing management abilities and teach them about security than it is to take an engineer and teach them security management skills.

>Having someone with no background in engineering running a department is suspect.

It's really not, because again, engineering != security. It's no more suspect than the CFO not having a background in engineering.

To use your analogy no surgeon is allowed to cut until he or she does have a solid grounding in biology.

I take it you're unfamiliar with the content of the MCAT exam, which is a prerequisite to admission to American medical schools.

Reply on news.ycombinator.com