Meaning does not hold a career together. What holds it together is the fit between what a person can do, the role in which they are expected to succeed, and the system that gives them authority and support. Responsibility without authority is not an attitude. It is a construction in which you cannot win.
In 2018 Timothy Brown, then head of information security at the software company SolarWinds, wrote one sentence into an internal presentation. The current state of security leaves the company very vulnerable with respect to its critical assets.1
A year later he wrote in another presentation that access and privileges to critical systems and data were inappropriate.1 Meanwhile, an engineering manager had sent him a risk acceptance form stating that the number of security issues identified in the past month had outstripped the capacity of the teams responsible for fixing them.1
He wrote it down. He flagged it. He passed it on. According to the complaint, there was more than one presentation and more than one form: a series of reports and conversations between 2018 and 2020.1
He had no control over the security budget. He did not manage the engineering teams that were supposed to fix the problems. And he did not decide what investors were told about the risks.
In December 2020 it emerged that an attacker had breached the company’s product and used it to reach government institutions and thousands of customers. In October 2023 the US Securities and Exchange Commission filed a lawsuit for fraud and internal control failures. It sued the company and one individual by name.1
Continue reading
Read the full article for free
Enter your email and the full article opens straight away. No payment, just a subscription to TORVAKO Insights.
- Full articles with all the sources they draw on
- Once a month, an overview of new articles and one story from practice
- You will be the first to receive TORVAKO study results
Already a subscriber? Enter your email and the article will unlock on this device too.
