Slashdot Mirror
Pennsylvania CISO Fired Over Talk At RSA Conference
An anonymous reader writes "Pennsylvania's chief information security officer Robert Maley has been fired for publicly talking about a security incident involving the Commonwealth's online driving exam scheduling system. He apparently did not get the required approval for talking about the incident from appropriate authorities."
What's the story here? He blabbed on a security issue without approval, and got his ass roasted.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Firing the guy will absolutely convince the public that you've fixed your security problems.
Seeing as careless talk can lead to image problems and/or lawsuits (or harming your case if prosecuting them). If you're in a senior position and you talk publicly in a work-related context, you talk on behalf of the organisation whether you intend to or not. OTOH if you are "blowing the whistle" on wrongdoing, there is a specific procedure for that which offers protection.
Now all your remaining security issues will fix themselves. But, don't worry, I'm sure Robert Maley will be happy to help you out - at 5 times what you were paying him.
Pain is merely failure leaving the body
From TFA: Over the past 18 months to two years, the administration has cut information security budgets by close to 38%, and staff by 40%. They also put a "lockdown" on talking about cybersecurity, the source claimed.
So instead of paying people to fix our security holes, we're just not allowed to talk about them?
Cluetrain Manifesto.... Dead. Slashdot Confirms.
I'm personally not interested in what comes out of any organization's public orifice because it always looks and smells like BS.
When they shut down their non-public orifices they become more and more useless. They lose value. real, actual dollars value.
In a way I'm more worried about this from a public organization because they have a monopoly on governance
and when they're doing it wrong they can keep doing it wrong a lot longer than a private company.
I'm simply rehashing the same thing I wrote over at SC Magazine's site:
We do not know all the facts behind the termination, but if was based primarly on his RSA appearance, that's a shame. There are so many variants of qualitative and quantitative risk assessment, that regular meetings with your peers seems to be just as critical with regards to understanding the important controls which need to be put in place. The days of leading with FUD appears to be in our rear view mirror, and building up a positive outlook in security by learning from the past and attempting to stay ahead of the curve is imperative to our support of the business or the public entity. What was the common theme with all the CISO's at RSA? Information sharing is critical and we're way behind. We don't share information, we put ourselves on "lockdown" and don't get invited to the table anymore as security professionals. We're seen as roadblocks, as negative drags on the bottom line. Something has to change or else we're going to lose ground as a country. In fact we already have.
Sharing information with other professionals is now critical to any InfoSec career. We do need to account for privacy, so a balance must be achived. Maley may have violated a confidentiality component of his employment, but that doesn't make the spirit of what he did wrong in any way. If anything, some clear guidance on what types of information is shared behind closed doors at peer review and group meetings at RSA should be discussed. You can't vette everyone who attends the meetings, but openness is a good thing, not a bad thing. More transparency is needed across the public and private sectors. More openness is needed among security professionals. The state of PA has it wrong. Lockdown is not a way to progress forward out of this losing battle with regards to properly securing the infrastructure while allowing the inevitable growth of technology and information.
Compromising your own ethics for revenge is a net loss. A vengeful, spiteful CISO would have about 0.00% chance of a new job that paid anything above "volunteer" wages.
Remember, CIO already jokingly stands for "Career Is Over." I don't think he needs to pile on "Career Is So Over" limiting moves by acting like a 13-year-old dumped by his first girlfriend.
John
Howard County, Maryland (back when I was living there -- might be many other places like this, too) decided to make the local parks "trash free." By removing the trash cans. I leave the results as an exercise for the reader ;)
timothy
jrnl: http://tinyurl.com/c2l8yr / foes: http://tinyurl.com/ckjno5
If I were him, I'd start spilling all the info I ever had on security for the state. No amount of money or threats would stop me.
Tut. Not sure how it is in your part of the world but some of us sign confidentiality agreements. I've worked for the British home office, some 30 years ago. I'm still bound by the "Official Secrets Act" that I signed then.
I'm not saying that some stories shouldn't be blabbed, but we're professionals. We do what we're paid to. If we're not happy, move on. But don't air dirty laundry. Especially not someone else's.
"The greatest lesson in life is to know that even fools are right sometimes" - Winston Churchill
A whistleblower reveals secret information to right a wrong. Perhaps there's a safety issue that is going uncorrected, or an unfair pay gap, or workplace racism, or where the bodies are buried. Those are kept secret to keep costs down at the expense of human health, or to protect the criminally negligent or guilty.
The GP said:
If I were him, I'd start spilling all the info I ever had on security for the state. No amount of money or threats would stop me. I mean any and every item.
There are plenty of legitimate secrets a CISO is expected to keep. Plans for upgrades that reveal current deficiencies but can't be implemented yet due to budget constraints. Ongoing operational security tasks. Or command and control structures: a list of the three key people without whom an emergency response would fail would provide a juicy target list for a serious attack. The identities of sting or honeypot operations. Those are all perfectly legitimate security items that should be kept secret.
A whistleblower is trying to correct an inequity. A traitor provides secret information only to damage an organization. See the difference?
John