Asides

Home Depot Breach 43M loss posting on LinkedIn

I just read an article on LinkedIn about the negative impact caused by the recent Home Depot breach. Here are my thoughts about how all the 2014 breaches should change some C level and Information Security paradigms. These could cause a major C suite thought shift and maybe even a large paradigm thought shift in how our profession thinks about the skills and talents really needed by Information Security professionals.

Note – I know this opinion will not resonate well with some CISO’s – Major IT departments continue to hire CISO’s that have little to no security background. Hackers and blackhats are associated with organized crime and IMO until we put more of an emphasis on the word SECURITY in the CISO title and until CISOs stop walking a tightrope by always trying to compromise and keep the business happy by letting the business need trump the security need (“ok, don’t patch that extremely vulnerable system I understand your business need not to” ) the crooks will continue to win.

Also, it appears that too many companies are basing their CISO hiring decisions on the candidate’s business acumen. Wouldn’t it be better to focus on how well the candidate knows how to fight and deter criminals?
I’m not saying CISO’s don’t need to understand the business I am saying that a stronger focus should be on how much the CISO knows about criminals and crime fighting. I also realize that thought would take a major paradigm shift in the thinking of the C suite.

Wow! My own webpage

My own webpage, who would have ever thought it?  I know back in the 8th grade when they gave us some sort of “here’s what you have the ability to be in your life” test and mine came back that I would be a fine ditch digger (really, that is what I was told by my 8th grade teachers) that not many of that crowd would have thought I’d be able to get to where I am professionaly and personally.

I am going to use this venue to talk mostly about Leadership in the area of Cyber and Information Security and the trials and tribulations associated with that profession.  The comments on these pages will be mine and are not meant to represent the beliefs or opinions of any of the companies I work with and for.

While I will do my best to focus on Cyber Security leadership I may have moments when my musings take me into mentoring, leadership and just life according to Kevin – but mostly the posts will focus on Cyber security.   The stories and musings will all be true but they won’t all be based on my own personal direct experiences – nor will I tell you which ones are based on my direct experiences as I do not want to embarrass any present or past employers.