The Best Defense Is a Firing Offense

What's a CSO to do when his tech expert says No to a request?

By Anonymous

December 09, 2002 — CSO — I've learned two important rules since becoming a CSO. One: You can't argue with a technology expert. And two: You've got to argue with a technology expert.

I remembered this particular lesson on a Tuesday. It hadn't even been such a bad Tuesday. That is, until Technology Guy came charging into my office.

"Forget it," he says to me, responding to an e-mail I had just sent him. "No way am I going to do that."

"Why?" I ask blankly.

"Because it doesn't make sense," he says. "It's stupid security. And when it fails, I'll end up taking the blame for it."

"Look, it's not your decision," I remind him, "nor is it mine. Big Boss has asked us to open the port in the firewall to support a new business application. You remember Big Boss," I say to him in my most controlled management voice. "He's the one with the big, cushy chair, approves the budget, signs your paycheck...."

"It's still not happening," he tells me, defiantly. "They're using Report Procedure Calls with that application, which require me to open up not one port but 2,000 ports, which makes my firewall worthless."

"Nevertheless...," I struggle to inject my own defiance.

"No way," he interrupts. "Not happening." He leans emphatically across my desk and looks me straight in the eye. "Tell them to rewrite their damn application, and tell them to use real software for a change." Then he storms out of my office before I can say another word.

Hoo boy. Technology Guy should walk a mile in my wing tips. He doesn't get that this issue is nonnegotiable. The ports need to be opened so that the app can run. Period. Firewall or no, we need to solve the app problem first. And there's no way they are going to recode the applicationthe company has a lot riding on this. I really need Technology Guy to help me out. But he doesn't seem to get the big picture: The business needs to make money to survive. This app will make money. Ergo, we need this app.

I give Technology Guy time to cool off and then walk down to his office. He's still fuming, however. He says there comes a time when every good technology guy has to put his foot down on bad security. Apparently he has chosen this moment. He calls me a wimp for not standing up to corporate. "Nothing personal," he says.

He thinks I should explain to Big Boss that we are all going to die because of security stupidity. I make one last attempt to explain, but he refuses to discuss it any longer. Technically speaking, of course, he's right. But Big Boss doesn't want to hear about security problemsthey only cost him time and money.