Cyber Defenders Are Often Not Fired, When Others Would Be

Published with Permission by:
Lint, James R., “Cyber Defenders Are Often Not Fired, When Others Would Be”, In Cyber Defense, 01 June 2017, Web,

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

If a security guard does not make his rounds at night and a door is left open, should he get in trouble with his superiors? Should he be reprimanded? If a robbery occurs because of the open door, should he be fired?

Is it fair then that cyber defenders or information technology security specialists are not fired after a cyberattack?

Cyber defense used to be a safe job after a crisis, if the IT specialists had documented what the company needed to protect itself from a cyberattack and management did not act on those recommendations and purchased the products or services that could have enhanced security.

Cyber Security Is Still Undefinable

Yahoo, LivingSocialFacebook and Twitter spent millions of dollars to protect their networks and data. Yet all were victims of massive cyberattacks. They discovered the truth in the security managers’ words of wisdom that “there really is no such thing as perfect security.”

Any system, building or company can be penetrated. No set of security measures will completely protect against determined cyber hackers. Security continues to evolve based on the threat actors.

If any company used the same security and firewalls today as it did in 2005, even amateurs in the security field would laugh. It would probably be smarter to invest in a welcome mat instead of a 2005 firewall. (There is a possibility that they would cost the same.)

What Cyber Defense Managers and CIOs Need to Do to Protect Their Jobs

In 2013, a credit card breach at Target put 40 million shoppers at risk. In the end, the CEO and the chief information officer lost their jobs. The incident illustrated how a cyber security incident can affect cyber leaders and managers.

The IT Security for Managers website noted that “Target, in fact, passed their compliance requirements several months before the breach occurred, but as evidence now clearly shows, they were not secure.”

To prove its point that compliant does not mean secure, the website recalled a historic tragedy. “[T]he Titanic was actually compliant with the British Board of Trade, which required all boats over 10,000 metric tons to have 16 lifeboats. It didn’t matter how many passengers were on board. Just put 16 lifeboats on. So was the Titanic compliant? Yes. Did compliance avoid a tragedy? No.”

Law360, a LexisNexis company website, reported on an internal probe of Yahoo’s “trio of data breaches believed to have affected at least 1.5 billion users.” The probe concluded that certain senior executives failed to adequately respond to the incident. As a result, Yahoo‘s general counsel resigned and CEO Marissa Mayer’s annual bonus for 2016 was withheld.

Protect Yourself and Your Organization

Documenting company safeguards is critical when corporate executives have to go to court for a breach of contract dispute or for a management hearing for termination. Here is a brief checklist that can help to protect you and your organization:

  • Know where your security response plans and procedures are located.
  • Can you prove you exercised those plans?
  • Did senior managers participate so they knew their responsibilities and can support you?
  • Alternatively, were senior managers notified of the exercises?
  • If not, why not?

Not involving senior managers in cyberattack plans, procedures and resolutions can be a career-ending decision. Cyber defenders should have written documentation to that effect. Every exercise should have a post-action report that shows what was learned, what was performed well, and where the weaknesses in training, equipment and processes were.

Free Information and Government Readiness

The Department of Homeland Security’s “Ready” program has information on before, during and after a cyber incident. The DHS also has information and a monthly newsletter at its Stop. Think. Connect. campaign.

A more technical email list is from the United States Computer Emergency Readiness Team (US-CERT) provides a more technical mailing list.

The information is out there to protect your organization. So stay secure!

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

0 replies

Leave a Reply

Want to join the discussion?
Feel free to contribute!

Leave a Reply