As Ex-Uber Executive Heads to Trial, the Security Community Reels

This article talks a lot about other "Chief information security officer"'s (or similar) being worried about what this means for them but it's not like Uber got ransomware'd and now this guy is in hot water. It's also not like this is a low-level engineer. This is a C-level exec who paid off the hackers and swept the whole incident (leaking of ~600,000 driver's personal data and some data on the 57M customers) under the rug.

> Prosecutors have accused Mr. Sullivan of obstructing justice and concealing a felony for not disclosing the breach or revealing it to the F.T.C.

He isn't being prosecuted for the hack but rather for his response to it. These CISO's who commented about him being scapegoated seem off their rockers. I have no doubt that this gross practice of hiding hacks and not altering affected people is somewhat common, that doesn't make it ok/right. For myself, I'm happy to see CISO actually sweat this stuff instead of knowing they can do a piss-poor job and walk away without consequences. That's what they get paid for, that's what the title is for, that's their freaking job. And again, I cannot stress this enough, based on this a CISO should only be worried if they get hacked and then try to cover it up.

There seemed to be two types of "security" people. Professionals, and jokes.

The jokes were just opportunists, they knew surprising little despite talking a lot, and just made busy work for themselves and everyone else / if they got a sense of the executive teams whims they'd go with it regardless of the security concerns.

The professionals valued input from security researchers, educated and guided the executive team, worked WITH the engineering teams, and were technically highly proficient / understood the law. They also had a very strong motivation to work with other professionals, avoid the joke guys, and work at places their input was valued / taken seriously. They really didn't want some big bungled breach at a company on their resume when they were there.

I can't imagine a professional would have taken the actions Sullivan did. If someone told me they were worried about how it might impact them... I'd be immediately suspicious of them.

Payoff no choice perhaps but the above move was a very bad esp when FTC is investigating your company.

It is no wonder they are going hard after him.