Quick, better lock down that CISO role. Salaries have apparently hit €1m

I think you'll find Talk-talk are probably one of the few who take it seriously and have invested...Nothing like a Grade A cock-up to make you think twice.

Re: Meaningless if...

In my experience, having a CSO is a good proxy for being prepared to spend time and money on security. It certainly doesn't guarantee good security practices, but NOT having a CSO is IME usually a sign of an organisation that really doesn't get it.

Re: Eye-watering CIxO salaries mean absolutely nothing...

*Roughly* £633,000? That sounds quite specific to me.

Some kind of fookin' tape drive that must have bought! Or was it £500 for the tape drive and tapes plus £632,500 on backup rotation design consultancy and tape changing training.

Unfortunately, that's largely the logic on some boards. You can ignore the CISO if he only cost 60k, but if he costs a million then he outranks the lesser boardlings. Which is, of course, why the beancounters and the lawyers tend to rule the roost.

> After all you paid more for it.

Sadly true. Also, of course, the principle that keeps high cost consultancy organisations in business.

I do wonder whether any studies have ever been done to see whether mega bucks executives are worth the money compared to cheaper ones. I suspect not for obvious reasons.

The other thing that makes me wonder is that the chief execs deputy seems to earn about half what the chief exec does, yet must surely be competent to step into his shoes at any time. So are the deputies wildly underpaid or...

Not even that.

The CISO has been promoted to a full member of the golfogarchy(*), the ruling caste in a golfocracy. His dept has been in the news long enough for the people who have the caste entitlement to use the "I had no clue what my employees were doing" defense in a trial or parliament committee hearing (they are marked with C in the title nowdays).

That, however, applies solely to the CISO. The low caste scum reporting to him is not getting any more dosh or any more budget for technical equipment as a result.

(*)_{In the meantime, the proles pray for the day when they will have a golf club shoveled up their arse}

Re: Having a million dollar/pound CISO wouldn't stop WannaCry

Actually, it might.

It's an accepted cultural thing in business that a man with a bigger salary carries more weight in discussion. If your CISO costs a million quid a year, he has much more clout to argue for whatever his expert staff say should be happening than a 50k CISO who is there simply so the company can say it has a dedicated CISO.

Sure, the real way of stopping individual bits of malware is to have good techies... but the CISO ought to be able to take what the techies say, convert it into boardspeak, and then successfully make the case that it ought to happen. His odds of successfully making that case are at least partially contingent on his salary being big enough to ean the respect of the other executive board members.

Re: Request for nano-violins

And with that kind of modesty and self-deprecating humour, I'll bet you don't rub people up the wrong way or strike them as arrogant at all.

Re: Request for nano-violins

Then you clearly don't want the job. All layers of security are short of good people so go and do 2-3 years as an Information Security Manager at one or two places, then get a CISO job in a smaller place. If you're any good at it then in ten years you'll have shed the nerd specs and will be more worried about decent au pairs.

Or stick to what you do because it suits you but don't complain.