Live data from Hacker News

Former Equifax CEO says breach boiled down to one person not doing their job

techcrunch.com

21–30 of 39 posts

Re: Former Equifax CEO says breach boiled down to one person not doing their job

#21

This is how it always goes down. - F*ck your customers over by gross negligence and sheer greed (or stupidity, or both) - Get caught with your pants down - Dump your stocks and cash out - Apologize when customers and media express outrage - Go to Congressional hearing and repeat the magic words "I do not recall" for every question - Find 1 low-level scapegoat employee - Fire that employee and declare that the company…

- collect $90 million and skip the jail part.

Re: Former Equifax CEO says breach boiled down to one person not doing their job

#22

There's a mantra at my company that you can't assign blame for a problem to a particular person. If one person is capable of breaking your system, you have a bad system. The focus isn't on finding the one person or the one mistake that caused it, but fixing the process so one person or one mistake can't wreak that much havoc. I think it's a very good philosophy.

Bought a book mentioned in another thread about understanding system failures.

If the conclusion blames an individual then 100% of the time the real problem is with the system that gave them that much power.

Re: Former Equifax CEO says breach boiled down to one person not doing their job

#24
post #22

There's a mantra at my company that you can't assign blame for a problem to a particular person. If one person is capable of breaking your system, you have a bad system. The focus isn't on finding the one person or the one mistake that caused it, but fixing the process so one person or one mistake can't wreak that much havoc. I think it's a very good philosophy.

Bought a book mentioned in another thread about understanding system failures. If the conclusion blames an individual then 100% of the time the real problem is with the system that gave them that much power.

What's the book? Would like to add to my reading list :)

Re: Former Equifax CEO says breach boiled down to one person not doing their job

#25

There's a mantra at my company that you can't assign blame for a problem to a particular person. If one person is capable of breaking your system, you have a bad system. The focus isn't on finding the one person or the one mistake that caused it, but fixing the process so one person or one mistake can't wreak that much havoc. I think it's a very good philosophy.

Has this mantra been stress-tested in the real world with a large scale data breach?

Edit: to add to his, what I mean to say is: it's great that (some) companies have this culture internally. It remains to be seen whether the mantra would survive a sufficiently large scandal. Maybe that's when the legal team comes in with the damage control plan as outlined in another comment by @justboxing.

Re: Former Equifax CEO says breach boiled down to one person not doing their job

#26

There's a mantra at my company that you can't assign blame for a problem to a particular person. If one person is capable of breaking your system, you have a bad system. The focus isn't on finding the one person or the one mistake that caused it, but fixing the process so one person or one mistake can't wreak that much havoc. I think it's a very good philosophy.

I remember the huge AWS outage that happened and was due to one engineering fat fingering a command. Instead of firing him they put in policies in place so that can't happen again.

Re: Former Equifax CEO says breach boiled down to one person not doing their job

#27
post #26

There's a mantra at my company that you can't assign blame for a problem to a particular person. If one person is capable of breaking your system, you have a bad system. The focus isn't on finding the one person or the one mistake that caused it, but fixing the process so one person or one mistake can't wreak that much havoc. I think it's a very good philosophy.

I remember the huge AWS outage that happened and was due to one engineering fat fingering a command. Instead of firing him they put in policies in place so that can't happen again.

Why would they fire him? He's the one person in the company who's never going to make that mistake again.

Re: Former Equifax CEO says breach boiled down to one person not doing their job

#28

This is how it always goes down. - F*ck your customers over by gross negligence and sheer greed (or stupidity, or both) - Get caught with your pants down - Dump your stocks and cash out - Apologize when customers and media express outrage - Go to Congressional hearing and repeat the magic words "I do not recall" for every question - Find 1 low-level scapegoat employee - Fire that employee and declare that the company…

- collect $90 million and skip the jail part.

lol. Yes. I added your point.

Re: Former Equifax CEO says breach boiled down to one person not doing their job

#29

Having just a single point of human failure standing in the way of leaking 145M people's data is already negligent. Trying to foist responsibility onto this poor individual (presumably some lower-rung employee) is shameful and just goes to show how ripe their corporate culture was for something like this to happen.

Nice of him to publicly testify to their gross incompetence , though. (And under oath too?)

Doubtless the various lawsuits will be coming back to this testimony for many years.

Re: Former Equifax CEO says breach boiled down to one person not doing their job

#30

This is how it always goes down. - F*ck your customers over by gross negligence and sheer greed (or stupidity, or both) - Get caught with your pants down - Dump your stocks and cash out - Apologize when customers and media express outrage - Go to Congressional hearing and repeat the magic words "I do not recall" for every question - Find 1 low-level scapegoat employee - Fire that employee and declare that the company…

And, if it is bad enough that a CEO has to be let go... they pop that fancy, golden parachute on the way down...
Post reply on HN