Winkler: Grab Your Company by Its Proverbial Balls

Never one to mince words, Ira Winkler shows how to make your CEO care about security

By Ira Winkler

February 10, 2010 — CSO —

A few years ago, I was called in by the CSO of a Fortune 25 company. He hired 4 of the best known companies that do penetration testing to find problems with their corporate network. All 4 companies came back two weeks and $100,000 later, and told the CEO that they had full control of his network. The CSO went immediately to the CEO, who basically replied, "I don't care."

The CSO then hired me to perform an espionage simulation. I came back within one week, and handed the CSO their mergers and acquisitions plans, their new technologies that were being released in three years, multi-billion dollar proposals, pictures showing how I bugged the CEO's office, and told him that I had full control of their entire network. The next week, the CEO raised the security budget by $10,000,000 and they hired security managers for all business units.

Also see Winkler's "I was wrong—there probably will be an electronic pearl harbor"


The reason that the CEO reacted that way is because I grabbed the company by their proverbial balls and squeezed. I showed him the pain related to bad security. A value was placed on the vulnerabilities and it showed the CEO that they had to be addressed.

I thought of this story as I read how Dennis Blair, the Director of National Intelligence, testified to Congress telling them how the Chinese hack of Google should serve as a wake up call. Frankly, while I admit that Google is a large American business, and the attack sounds outrageous, I have to reply, "I don't care."

In the grand scheme of things, China can hack Google, but the overall effects to the United States are rather minimal. Besides of the fact that you don't want to see any U.S. company being targeted by a foreign nation, the hack of Google really has no impact on the U.S. It is much more likely that the 33 other companies that were hacked by China during the same attacks, which of course don't get any press, pose a much more dire threat to the U.S. and its economy.

At this point, I really don't see how China can do much worse than has already been well reported over the last 5 years. It is widely acknowledged that China hacked the White House, the Obama and McCain presidential campaigns, and much more importantly has an ongoing, massive hacking campaign against the Department of Defense, Department of Energy and their contractors. China has already compromised weapons and missile technology. Why is hacking Google now a wake up call?

RESOURCE CENTER