Hacker News Reader

If we're being critical here, I'd also argue that often the CISO's job and main concern is simply making sure they have the right paperwork and motions in place to pass a given set of industry audit standards. These people are not always even capable of understanding the technical security of a product.

Paper security like this is often a minimum bar, and sometimes even below minimum when the audit checklists lag best practices like "password rules" requirements did for so long.

I agree that if the CISO is liable, they should also actually be responsible, but making the CISO responsible won't by itself fix the industry's security issues.

The password example feels egregious, but keep in mind that the investigators spent months if not years combing through corporate records and are now showcasing the most embarrassing finds in the framing of their choice. I bet there's not a single company in the world where some engineer didn't at one point set up a dumb password as a part of some one-off integration. The job of the security team is to systematically track down stuff like that, but you never reach 100%. There are things you don't see.

What feels particularly weird here is that SolarWinds wasn't compromised by a Bulgarian cybercrime gang. They were compromised by a nation state. While the SEC is notionally focusing on other stuff, this is ultimately the company's original sin. How many businesses, no matter how strong their security posture, can really say that they're immune to that?

The problem is not being hacked. The SEC doesn't want companies to be hack proof or to force them to dump millions into security.

They want companies to be more transparent and honest with shareholders about their current security gaps and for them to report hacks in a timely manner. It's fine to be insecure but honest, what is never fine is lying to investors.

Bad investments are fine, bad investments pretending to be good ones aren't.

I'm not here to defend SolarWinds, and it's entirely possible that they were a "bad investment pretending to be a good one", but I have some issues with this framing.

First, contrary to your assertion, there is no doubt that they're in trouble because of getting hacked by a nation state (and dutifully disclosed it). This wasn't some routine audit, wasn't a whistleblower complaint. The only reason the SEC went after them is that they had the misfortune of falling prey to an attack that few other businesses could conceivably repel. So, I'm not sure that's sending a great message.

Second, the complaint isn't showing that the company brazenly and deliberately deceived investors. It's not that the SEC peeked under the hood, immediately realized this is messed up, and had to act. No, they spend months poring over every email - and all they came up with is not exactly a smoking gun. The whole complaint is basically "the company only made generic investor disclosures, but we found instances where specific employees pointed out more specific deficiencies."

Ignoring the one-sided narrative of the complaint, the actual quotes they have don't paint the picture of a deliberate conspiracy. They paint the picture of normal day-to-day communications where people sometimes say dumb things, blow things out of proportion to try to get resources, etc.

I think your stance is way more balanced, I was mostly speaking to what I believe is the message the regulator wants to send, regardless if it's fair in its essence. Thanks for balancing out the thread.

The thing that was so egregious about Solarwinds is that, given their line of business, they were obvious targets for nation state actors. This is similar to any business that itself is a supplier of highly privileged software to large numbers of clients (e.g. password managers or cloud providers are in the same boat).

And while the password example could have been a one-off, everything I've read about Solarwinds says they had a horrendously bad security culture. Bad security cultures are essentially unfixable without a top-down, CEO-driven initiative that places real carrots and sticks for individuals' security posture. Even then, 95% of these initiatives are bullshit, because they boil down to "Security is our top priority! Oh also if we miss our revenue targets a bunch of people are getting fired."

I think the CISO's actions were pretty bad, but I also think there are lots of other execs at Solarwinds who are quite happy he's now the sacrificial lamb.

Nation states like anyone else have budgets. No company is immune to the full weight of a major nation state but most of the time that is not brought to bear. You don't need to be impossible to hack, you just need to be hard enough that the value provided is less than the effort required.

Still a pretty tall order, but a few steps down from impossible.

Isn't this a "I don't have to be fast, just faster than you" scenario when a bear is chasing you and all your peers?

There's always going to be a curve and if anyone on the front side of the bell curve is below the threshold for "worth the effort" then this seems like a useless goal. I agree with other posters that this is more about transparency.

>I get it that the SEC wants to change this culture and have a designated person meaningfully responsible for infosec risk, but it feels that it's a case of stick before the carrot.

They have that already, it’s the CEO - he is supposed to have ultimate responsibility which is why he (or she) gets obscene compensation. They should be incentivized to hire the best CISO he can find because he’s facing jail time if he doesn’t.

Instead he has 0 responsibility because literally everything is an underlings fault.

It's somewhat wild: I remember as a kid being taught that those with the power are the ones with the responsibility. And yet once I entered the workforce, it turns out it's the opposite.

They do have the responsibility, the responsibility to appoint the appropriate fall guy in accordance with the wishes of the board.

While this may be true most of the time, there are cases where the CEO has taken full responsibility. A podcast [1] by Darknet Diaries on a breach in 2015 at mobile provider TalkTalk in the UK tells of such a case.

[1] https://open.spotify.com/episode/4fihCSOPKrIDXPB2azNgOc?si=3...

Here it's worth remembering that CISO is a "specific" role; it does not necessarily connote "most senior security person in the company"; some companies have more than one; some companies have a "CSO" and/or a chief of "risk"; at Apple (for all I know) it might just mean "most senior security person in IS&T". Apple has a sprawling and multifunctional security team.

If your claim is that all of security at Apple somehow reports up through IS&T, I have some reason to believe that is not the case.

No, the bulk of security and privacy work at Apple happens elsewhere.

Oh, we're saying the same thing, and I misconstrued you; I thought you were making a comment about how lackadaisical Apple is about security, but you're just saying "CISO" isn't that big a thing. I agree! Sorry about that.

He's being sued for his actions not because of his position - he was responsible for acknowledging the issues internally and not acting on them, he was responsible for the language of statements made to shareholders that misled them about the state of security.

If he had sent an email to the CEO saying "we have a problem, we need to do something about this" and the CEO had overruled him, the CEO would be being sued directly.

It doesn't really matter what his role or how high up he was - he was found standing over the body holding the smoking gun.

The problem wasn't that they had bad security and were hacked. The problem is that they lied to investors about their security and about the hack. So if a CISO was the one telling the lies (and you seem to acknowledge that their main purpose is talking to clients, but maybe its also talking to investors) then they seem to be the right person to charge even if they weren't responsible for the bad security.

I don't know security law at all but I have always seen CISO equivalent positions to be "Director" level, reporting typically to the CFO or to A C-level of some org who reports to another C-level and so on depending on size and complexity. But you are right in that they're just regular mid level managers, not directly accountable to the board.

"Directors and officers" are a special legal category, basically the highest-ranking people making material decisions about the business day-to-day. They are subject to special reporting requirements, such as having to file paperwork whenever selling or buying stock (which usually needs to happen under a trading plan). They often have specialized contracts, company-provided liability insurance, and a variety of perks you associate with "real" executives at public companies - from corporate jets to eight-figure salaries. We're talking about the CEO, CFO, CTO, and so on.

This is similarly-sounding but completely separate from the "director" job level at a typical tech company, which is basically just a senior manager of a large team or maybe the lead of a mid-size department. Your average CISO is probably in this ballpark, commonly at least 2-3 reporting levels below real C-leadership.

This.

With respect to SolarWinds, we need only defer to their proxy statement to discover who the real shotcalling directors[1] and executives[2] are.

[1] https://www.sec.gov/Archives/edgar/data/1739942/000173994223...

[2] https://www.sec.gov/Archives/edgar/data/1739942/000173994223...

The CISOs I've worked with were usually Directors, or VPs, and in 3 cases so far, lawyers who made it into IS/IT management. Their CISO duties/powers were thin. Head-nods and "let's set up a separate meeting for that" level.

So they're basically a whipping boy?

P.L.E.A.S.E.