Hacker News Reader

Comment by rdl | Hacker News Reader

I actually think the Target CISO (or CIO maybe) job would be awesome. Target as a company overall is great; they might not be up to standard on IT/IT Security, but now that the board sees how IT and IT security can affect their bottom line (or indeed existence), whoever takes the role should be able to do amazing things. Plus, it's high visibility when you succeed.

View on HN

> Plus, it's high visibility when you succeed.

Actually, no. That is one of the biggest problems with properly functioning IT systems, they become invisible - nobody notices until something screws up...

I think that's true at smaller organizations where the head of IT isn't on the exec team. But at large companies, the head of IT is a pretty serious role (Jacob was CIO/EVP), with a very large budget, mission-critical systems, and a big team. Someone who successfully runs IT at a company like Target can pretty much get hired into a similar role at any other Fortune 500 company.

In general, yes, but after a company has gotten fucked as much as Target, it's pretty easy to turn this into a high-profile "we must bring the US payment card industry into the 1980s!" position.

CIO to me is just a job that the CEO can cut loose if some disaster happens to save his ass. Nobody needs a CIO around to ponder about IT security. It's something that has to be owned by individual admins and developers. The CIO can dictate strategy or policy or whatever, but its going to be individual mistakes like playing loose with credentials or messing up configuration that lead to data breaches.

CIO is a lot more than security. In some companies, CIO is on par with CFO in importance.

CISO sort of exists to get thrown under the bus, but in a regulated industry, has a huge compliance role.

The whole point of policy is to resource the whole thing adequately so individual mistakes get prevented, or caught and corrected, before they turn into a Target-scale problem. But that usually requires doing more than just bare compliance minimums, and is only possible with board level support for that kind of thing. Probably exists at Target now. Probably didn't before.

Have you ever worked with POS systems before?

Sadly, yes (retrofitting NFC into them, basically the inverse of what Square does, in 2003)

Reply on news.ycombinator.com