|
|
|
|
|
|
by tptacek
2998 days ago
|
|
|
What if the CSO informed engineering teams, got stonewalled, and, a few weeks later, escalated through the company's risk process (Panera is public, or was before it was bought by a public company, and will have a risk process). What do people here think a CSO does? If your mental model is: "decree that something is safe to deploy publicly, or else forbid its deployment", your model is broken. Most CSOs have an advisory role in the organization, and the real institutional power comes either from engineering or from the CIO. This security director handled Dylan's bug report badly and deserves the reputation hit he's getting. But if we're going to suggest liability (let alone criminal liability) for security flaws, we should at least have some idea of what it is we're regulating. |
|
|
The final "stick" and reason for a C in the title is the responsibility to shut down the data (and website) until such a point it can be secured.
It's should be considered more of a fiduciary duty (protect shareholders, customers) to protect data as making the right investment or HR decisions.