Should I block port 80?
Yes, including 80 and 443.
He was purely a GRC monkey that had absolutely zero technical knowledge, he just knew how to check boxes. It took way too long for me to explain to him that closing those ports would take our SaaS down entirely, and I was absolutely appalled that I had to have that discussion and started questioning how the hell this guy became a CISO.
I've heard some people argue that CISOs don't need to be technical, but I wholeheartedly disagree and can't fathom how anybody could think that someone who manages something should be able to get away with not having any knowledge in the field they manage. Like, I get that the IC track and the management track are completely different skillsets, but once you get to that level, you should have both sets of skills. I wouldn't want a CTO that doesn't know how to code, and I'd be terrified of a CFO that doesn't know accounting.
Btw, compliance auditors are required to be CPAs.
The thing is, I wouldn't actually have the authority to make the change. I'd have to convince someone from DevOps/SRE to do it, and they were certainly not gonna do it.