How to survive as a CISO aka 'chief scapegoat officer'
- Reference: 1745877457
- News link: https://www.theregister.co.uk/2025/04/28/ciso_rsa_whistleblowing/
- Source link:
And if they blow the whistle, it's best not to sue their employer as well, lest they get blacklisted.
Those were among the nuggets of advice given at an [1]RSA Conference panel on [2]CISO whistleblowing Monday. [3]Dd Budiharto , a former CISO at Marathon Oil and Philips 66, told her audience one past unnamed employer fired her for refusing to sign off on bogus invoices. Preparation, relationships, and choosing not to sue helped her get out of the situation with her reputation intact.
[4]
"I'm proud to say I've been fired for not being willing to compromise my integrity." she said.
[5]
[6]
"My thoughts were, 'I actively cannot agree with what is happening, I have to use my voice, I have to speak up, I have to tell the leadership and then see how the leadership responds to that,' and then I had to make a tough decision. I have a family to take care of and did not have a golden parachute to fall back on, but it really starts with you as the person."
In this case, she refused to OK invoices for work a developer hadn't delivered. After escalating the matter to the leadership, she says, she was reprimanded and investigated by HR, and her line manager made a number of false accusations, which she was only able to refute thanks to strong relationships built with other members of staff. After she left, she says, the company found out she was right.
[7]
Although she did lose her job, she decided not to sue over the issue, saying such a move would leave a "black spot" on her record and may cause her employer to smear her throughout the industry. Besides, she already had another job lined up. All three of the CISOs on the panel agreed that was a wise move.
[8]
The CISO panel at the RSA Conference. From left, moderator and co-founder of Cyber Security Tribe Dorene Rettas, Herman Brown, Dd Budiharto, and Andrew Wilder.
Another panelist said security officers should insist that bosses fund two insurance policies - directors and officers insurance (D&O) and personal legal liability insurance (PLLI) - before signing on to a new company. These policies have been standard for corporate officers for decades, explained Andrew Wilder, CISO of veterinarian network Vetcor and adjunct professor of cybersecurity at Washington University in the US.
"You want to have personal legal liability insurance that covers you, not while you are an officer of an organization, but after you leave the organization as well," Wilder said, adding that CISO meant "chief scapegoat officer" to some companies, who think firing their head of security after a cyber-incident will somehow help things.
"Both of these things are table stakes for CFOs, and have been for many, many years. I've talked with CISOs, who have been whistleblowers who have had to go to court later, and they've had to take all of those court costs personally, and you don't want to be in that situation."
Wilder cited the case of his friend Joe Sullivan, the former CISO of Uber, who was [9]convicted of obstruction of justice and not reporting a crime after he covered up a 2016 security breach and tried to disguise a ransomware payment as a bug bounty. Sullivan hired a PR company during the court case to shore up and repair his reputation, and the Uber-provided PLLI covered the cost, Wilder noted.
[10]Average North American CISO pay now $565K, mainly thanks to one weird trick
[11]Trump's DoD CISO pick previously faced security clearance suspension
[12]Ex-Uber CSO gets probation for covering up theft of data on millions of people
[13]70% of CISOs worry their org is at risk of a material cyber attack
It's also important to negotiate a golden parachute, Wilder commented, because that will make blowing the whistle a purely ethical decision, rather than a financial one.
Finally, while suing an employer might get you the cold shoulder, blabbing to the media is even worse.
[14]
"I think it's an even higher level of blacklist possibility if you go to the press," he said.
Document, and don't trust HR
Even if there's no whistleblowing event on the horizon, CISOs should document everything they do and every conversation they have, warned Herman Brown, CIO for San Francisco's District Attorney's Office.
"Email is a great form of documentation that doesn't just stand for 'electronic mail,' it also stands for 'evidential mail,'" he opined.
After every meaningful phone conversation, Brown says he sends the participant(s) an email covering the major points. Not only is it good backside-covering practice, occasionally it has uncovered something that was miscommunicated, he said.
All the panelists agreed on this point. Not only does the practice lead to a discovery trail after an incident, but it's also very handy to keep an eye on operations, make sure everyone is on the same page, and keep board directors informed.
"The document, having governance, having policies in place, and having that on [the] document is educating your leadership team on cybersecurity and letting them know that cybersecurity is not just a CISO responsibility; it's an organizational responsibility."
Similarly, if the CISO attends board meetings they should make sure they all comments are entered into the meeting minutes, particularly if a controversial topic that impacts the CISO's role comes up. Such minutes can be very helpful if it all turns legal.
One final piece of advice from Budiharto was never to trust human resources or ethics panels within a company. HR departments operate for the benefit of the employer, not the employee, she warned, and if you blow the whistle against a boss you are certain to be thoroughly investigated yourself. ®
Get our [15]Tech Resources
[1] https://www.theregister.com/special_features/spotlight_on_rsac/
[2] https://path.rsaconference.com/flow/rsac/us25/FullAgenda/page/catalog/session/1727392520218001o5wv
[3] https://www.rsaconference.com/experts/dd-budiharto
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/spotlightonrsac&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aBFL8fzqMKv2VkZm9X2-cQAAAcQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/spotlightonrsac&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aBFL8fzqMKv2VkZm9X2-cQAAAcQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/spotlightonrsac&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aBFL8fzqMKv2VkZm9X2-cQAAAcQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/spotlightonrsac&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aBFL8fzqMKv2VkZm9X2-cQAAAcQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://regmedia.co.uk/2025/04/28/ciso_panel_rsa_conference.jpg
[9] https://www.theregister.com/2023/05/04/uber_cso_joe_sullivan_sentenced/
[10] https://www.theregister.com/2024/10/03/ciso_salary_survey/
[11] https://www.theregister.com/2025/02/19/trumps_pentagon_ciso_pick_was/
[12] https://www.theregister.com/2023/05/04/uber_cso_joe_sullivan_sentenced/
[13] https://www.theregister.com/2024/05/23/cisco_survey_2024/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/spotlightonrsac&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aBFL8fzqMKv2VkZm9X2-cQAAAcQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
"never to trust human resources"
Pratchett's Archchancellor Ridcully offered his expert opinion that an individual ..."would only be a burden to the profession... [that] can look at a sign sayin' ' Human Resources Department ' without detecting a whiff of brimstone."
Understandably the Archchancellor also didn't have a particularly high opinion of comparative fretwork.
A Collegiate Casting-Out of Devilish Devices
Is a CISO role really a CISO role if you don't attend board meetings?
The majority of CISO roles I have seen advertised have not been CISO roles at all, much more like a senior ISO or even just Security Managers.
I wouldn't regard "Head of Security" necessarily to equal "CISO" either. There is little standardisation in these roles I suppose.
And if you've actually done your time working in security you should already be well versed on covering your own arse. It should be taught in the apprenticeship programmes.
I think I'd be inclined simply to do something else.
Whereas I may be no great loss to information security, creating an ever-more hostile environment is ultimately going to backfire.
There will always be some creeping bastard ready to pick up any job that even implies C-suite.
They won't know much about security but they will be gifted in greasy talk, avoiding blame and jumping ship just before the iceberg hits. I'm sure you know the type. They usually do very well.
If you care about doing the job well you probably have already avoided being promoted too far, been pushed out, or you're so jaded you no longer give a toss.
not worth the headache
Was going to be CISO, decided 5 years ago I didn't want the liability.
I went from being the info sec problem solver to a report monkey, 'cause the new management couldn't value in things that they can't put on a pie chart.
glad I'm old and almost done with - everything.
Enjoy your life! I wish I could but it's to late.
Tech/work/ has no real value, find love if you can.
I kind of got the clue….
…. when the outfit I used to work for changed the name of Human Resources (the organization formerly known as Personnel) to “Human Capital Management.” In my experience, all the employees began pronouncing “Capital” as “Cattle.”
Yes but,
I agree with this article.
One point,
> HR departments operate for the benefit of the employer, not the employee,
Yes, but. HR reps are required to keep and document some information, and retain that information, and are subject to legal discovery. While you can say the same about e.g. e-mail being recorded for everyone in the company, I personally consider this a higher bar. (It's also "enriched" data - no one has to put together 30 streams of e-mail and try to figure out what's going on.)
If something is amiss, if you're having any sort of problem in the company with another, make HR aware. You don't have to follow-up, you don't have to document it or ask for their intervention, but ensure that HR is aware at the earliest opportunity. If something happens later that appears to be an escalation of this, you have documented evidence of a timeline if needed, for internal processes or external legal processes - and they're required to document it and it will be discover-able. It also gives you something to reference, and perhaps even something to reference back on when you're explaining to HR that an issue is growing your concern, "what should I do here?" Make them tell you, and record, what you should do in that interaction. If they tell you to break the law, it'll be documented, right? :-) So they won't. (If they do, it was a company order, doing your job, documented the problem, yada yada.)
Overall, ensuring that things operate smoothly is in the best interest of the company. Ensure problems are resolved, ensure that they don't develop, don't escalate, and don't become dirty secrets. Use the HR team -- they're responsible for ensuring that you don't have a problem. Use them _early_ so that you don't end up being a _problem_ that they have to deal with.
Personal take: If you're having problems at a company, whether from HR or managers, or even just multiple coworkers, perhaps you shouldn't be at that company. Perhaps you should leave of your own accord, before things get bad. Look for something else while you bide your time, and GET OUT. I mean - the alternative is forcing their hand, right? That means you're a problem.