Slashdot Mirror
Pennsylvania CISO Fired Over Talk At RSA Conference
An anonymous reader writes "Pennsylvania's chief information security officer Robert Maley has been fired for publicly talking about a security incident involving the Commonwealth's online driving exam scheduling system. He apparently did not get the required approval for talking about the incident from appropriate authorities."
Firing the guy will absolutely convince the public that you've fixed your security problems.
(had to make sure I hit the "Post Anonymously" button...)
I'm one of many server administrators for LUTX, the (US) Federal Government IT "swat team" that was put in place during the Clinton Administration. One day I was working on a code-blue 456 system using the X-K-Red-27 technique and suddenly a bunch of drunken Canadian's broke in and try to SSH the HTTPS server. Well, as you can imagine, all hell broke loose and we had to double-slot the uranium deuteride fast on the flip-flop before the Russkies could notice.
I hope I don't get fired for sharing this amazing story with Slashdot
The same reason I don't want nuclear regulators getting fired for admitting when there was a heavy water leak into an aquifer.
Seeing as careless talk can lead to image problems and/or lawsuits (or harming your case if prosecuting them). If you're in a senior position and you talk publicly in a work-related context, you talk on behalf of the organisation whether you intend to or not. OTOH if you are "blowing the whistle" on wrongdoing, there is a specific procedure for that which offers protection.
If this were a private company I'd be of the opinion that their internal security is their concern but this is a government office and the people who pay the bills have a right to know what's going on.
Now all your remaining security issues will fix themselves. But, don't worry, I'm sure Robert Maley will be happy to help you out - at 5 times what you were paying him.
Pain is merely failure leaving the body
The important paragraph in TFA:
"Maley's dismissal comes amid ongoing budget and staff cuts at Pennsylvania's IT security organization, the source said. Over the past 18 months to two years, the administration has cut information security budgets by close to 38%, and staff by 40%. They also put a "lockdown" on talking about cybersecurity, the source claimed."
Now there's a good plan: If you don't talk about it, no one will know you have a problem, and you can save all that money you were spending on those annoying security types.
If I were him, I'd start spilling all the info I ever had on security for the state. No amount of money or threats would stop me.
I mean any and every item. I'd expose every stupid supervisory move that compromised security and my ability to protect the network. EVERYTHING would be exposed.
Nothing worse than people getting their panties all in a wad over a "talk" about a well publicized incident, of which all the bad guys already knew about.
There is only one thing these people understand, and that is how to look good. Ruin it for them.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
The firing seems heavy-handed. Don't you want your Chief Information Security Officer participating in industry security conferences, selectively sharing the experiences of your organization with security professionals so as to help find long term solutions? Who knows... maybe he shared some sort of special classified/secret/private data that he really ought not to have, but it sounds like good old bureaucracy + control freaks at the top who think it's all about militaristic need-to-know.
-1, Too Many Layers Of Abstraction
Apples and oranges, one is a health risk, one isn't.
Which one is it?! Who knew picking from the fruit basket would be like playing russian roulette?
Give me Classic Slashdot or give me death!
If this were a private company I'd be of the opinion that their internal security is their concern but this is a government office and the people who pay the bills have a right to know what's going on.
If the internal security failure lead to your private information being leaked and the possibility of financial loss to you, I think that you might be of the opinion that there should be legislation which deals with disclosure. Actually, there is such legislation in many jurisdictions. And you also have Sarbanes–Oxley stuff which is supposed to encourage whistleblowing.
Some "internal" things are more internal than others....
This is probably one of the most specious arguments anyone ever trots out about someone breaking (or overlooking) a rule, especially in organizations known for coming up with rules for every single thought or action one engages in (e.g. a bureaucracy). Unless the incident was actually ongoing, or had the potential to risk the security or integrity of the systems it was his job to oversee, talking about a past incident germane to the topic of the conference is what people do at conferences. That's the entire point. Yes, he violated a minor rule. "Oh lordy lordy, who will he kill next?" is not really the best response to the situation.
Government (and bureaucracies) tendency to not fix anything like that until they have to.
Public outcry over the situation is one way to increase the 'have to' value.
Also, keeping problems secret has always been a major dodge for not having to deal with an issue.
Who fired him?
According to public records having to do with reporting structure, he would have been fired by Brenda Orth, CIO (Chief Information Officer) in the OA (Office of Administration, Commonwealth of Pennsylvania). The reporting chain is easily verifiable using either the Google cached copy of their page, or the Internet Way Back Machine.
She basically reports to the state Governors staff, so there's no telling how far up hill you'd have to go to find the source of the firing, but as his immediate supervisor, whe would have been the one to pull the trigger.
-- Terry
There is a distinction between "acknowledgment" of an already known problem and the "announcement" of a brand new one. Hackers know about the problem already, and apparently it was widely known how to game the system, so this was only an acknowledgment. The CISO didn't reveal anything new, although it was apparently new to this particular audience.
By making future CISOs afraid for their job, the governor has poisoned the CISO's ability to actually perform their duties.
John
Do you really want the taxpayers having the root password?
I'll give them to you. There are actually two root passwords to the Constitution: "terrorism" and "child pornography". By using either password, you can bypass any of the security protections or protocols built into the document, and you can invalidate its signatures.
John
The first rule of Commonwealth's online driving exam scheduling system is: You don't talk about Commonwealth's online driving exam scheduling system.
#DeleteChrome
Ooh, ooh, ooh; want to learn how to defend yourself against pointed sticks, do we? Getting all high and mighty, eh? Fresh fruit not good enough for you, eh? Well let me tell you something lad! When you're walking home tonight and some great homicidal maniac comes after YOU with a bunch of loganberries, don't come cryin' to me!
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton