Slashdot Mirror

← Back to Stories (view on slashdot.org)

Pennsylvania CISO Fired Over Talk At RSA Conference

Posted by timothy on from the perfecting-the-art-of-the-ham-fist dept.

An anonymous reader writes "Pennsylvania's chief information security officer Robert Maley has been fired for publicly talking about a security incident involving the Commonwealth's online driving exam scheduling system. He apparently did not get the required approval for talking about the incident from appropriate authorities."

7 of 147 comments (clear)

  1. Good job... by kurokame · · Score: 5, Insightful

    Firing the guy will absolutely convince the public that you've fixed your security problems.

  2. Re:Motormouth failed his talking test? by DoofusOfDeath · · Score: 5, Insightful

    What's the story here? He blabbed on a security issue without approval, and got his ass roasted.

    The same reason I don't want nuclear regulators getting fired for admitting when there was a heavy water leak into an aquifer.

  3. reasonable? by DaveGod · · Score: 5, Insightful

    Seeing as careless talk can lead to image problems and/or lawsuits (or harming your case if prosecuting them). If you're in a senior position and you talk publicly in a work-related context, you talk on behalf of the organisation whether you intend to or not. OTOH if you are "blowing the whistle" on wrongdoing, there is a specific procedure for that which offers protection.

  4. Re:Motormouth failed his talking test? by firewrought · · Score: 5, Insightful

    What's the story here? He blabbed on a security issue without approval...

    The firing seems heavy-handed. Don't you want your Chief Information Security Officer participating in industry security conferences, selectively sharing the experiences of your organization with security professionals so as to help find long term solutions? Who knows... maybe he shared some sort of special classified/secret/private data that he really ought not to have, but it sounds like good old bureaucracy + control freaks at the top who think it's all about militaristic need-to-know.

    --
    -1, Too Many Layers Of Abstraction
  5. Re:Motormouth failed his talking test? by plover · · Score: 5, Insightful

    There is a distinction between "acknowledgment" of an already known problem and the "announcement" of a brand new one. Hackers know about the problem already, and apparently it was widely known how to game the system, so this was only an acknowledgment. The CISO didn't reveal anything new, although it was apparently new to this particular audience.

    By making future CISOs afraid for their job, the governor has poisoned the CISO's ability to actually perform their duties.

    --
    John
  6. Re:Motormouth failed his talking test? by plover · · Score: 5, Insightful

    Do you really want the taxpayers having the root password?

    I'll give them to you. There are actually two root passwords to the Constitution: "terrorism" and "child pornography". By using either password, you can bypass any of the security protections or protocols built into the document, and you can invalidate its signatures.

    --
    John
  7. Re:The key paragraph by timothy · · Score: 5, Insightful

    Howard County, Maryland (back when I was living there -- might be many other places like this, too) decided to make the local parks "trash free." By removing the trash cans. I leave the results as an exercise for the reader ;)

    timothy

    --
    jrnl: http://tinyurl.com/c2l8yr / foes: http://tinyurl.com/ckjno5