The growing trend of finding CISOs personally liable for security failings is making security professionals more reluctant to take up these positions.
This according to former Uber CISO Joe Sullivan, speaking during Black Hat Europe 2023.
Sullivan was convicted in 2022 of federal charges relating to the cover up of the theft of Uber drivers' and customers' personal information from 2016.
He highlighted the wider impact of recent cases of CISOs being held personally liable for security incidents at their organizations.
CISOs Face Increasing Legal Scrutiny
In addition to his own case, Sullivan cited recent charges levied by the US Securities and Exchange Commission (SEC) against SolarWinds and its CISO, Tim Brown, for allegedly deliberately downplaying or failing to disclose cyber-risks while overstating the firm’s security practices. The charge statement argued that Brown is not only responsible for what SolarWinds has done in relation to security, but also has responsibility over what the firm has said about it.
In Sullivan’s conviction, which he is currently appealing, the judge made it clear that if he received a similar case in the future, he would send the defendant to prison.
The former Uber CISO said that the trend of holding security leaders responsible for their company’s security failings means CISOs “are not thinking about the big picture, they’re thinking about themselves,” and some even considering leaving the profession.
He added anecdotally that he has had prospective CISOs ask him ‘why should I take on this personal risk?’
The Unique CISO Role
The average person on the street would think it reasonable that a CISO should be responsible for all aspects of an organization’s security, Sullivan acknowledged. However, the reality is the CISO role is unique among executive positions.
“The CISO is fighting an uphill fight every day in their job. They’re begging for resources, they’re trying to get the rest of the company to slow down and think about the things they care about,” he noted.
No tags.
