Call us now:
One to watch and thank you Mahbubul Islam CSyP for this article.
The article raises a number of interesting points, which security professionals should be aware when they deal with a hack, as the boundaries between law enforcement and cyber security get closer. Putting increased pressure on the heads of security and at odds with senior leadership. If the appropriate structures are not in place to govern cyber at the board table.
If the facts as described in the report are correct. The head of security and CEO at the time used a bug bounty scheme to pay hackers following access to sensitive data. The way the data loss was handled (an issue of itself) led to a failure to report the data breach to the FTC for 1 year. The subsequent $148Mn penalty to settle lawsuits and a 20 year FTC oversight of Ubers privacy and security systems.
It brings to light the way data breaches are handled, the role the head of security plays and their independence to the board. Whilst cyber is a difficult function to oversight there is a need for appropriate and independent oversight of the function.
What does intrigue me is the then head of security was an Assistance District Attorney, earlier on in their career. The same office which brought the charges against him.
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6702503421481644032