Thread by @MalwareJake

Dear infosec (pardon the thread),
Don't celebrate too hard at the thought of jailing CEOs for failing to protect data. First, it won't pass. Even if it does, it won't mean what you might think. It won't create a SOX style environment around cyber. Sorry 1/ gizmodo.com/wyden-unveils-…

What's far more likely to happen is that GRC will rule infosec. If there's anything we don't need, it's more paperwork for paperwork's sake.

It will also bring an end to the lack of licensure in infosec. Ever wonder why there are so many requirements to be a CPA? 2/

Hint: it's not because CPA is old and infosec is new. At least part of the difference is that screwing up accounting results in jail time for someone. Screwing up infosec usually means you update your resume, blame your boss for insufficient resources, and move. 3/n

Sure that's cynical, but I don't think it's far off. Professional licensure is not good for a profession this young. If you think I'm wrong, just look at what CREST has done overseas. It's an unofficial infosec taxation body that stifles innovation. 4/n

For better or worse, anyone in the US can start an cybersecurity consultancy. Not so in many areas - you have to wade through CREST requirements to get meaningful work. CREST talks about how this protects members. It certainly does. But it hurts the community as a whole. 5/n

Ever wonder why you never hear about "the DEFCON of accounting conferences?" That's because it doesn't exist. Generally speaking, professions with legally mandated professional bodies don't have gatherings like that. I'm not advocating for being idiots, but for innovation. 6/n

Lots of innovation occurs when people can try new ideas in a (mostly) judgment free zone. That won't happen under this sort of legislation. Old IT nerds know the adage "nobody ever got fired for buying IBM." Expect more technology consolidation under this too. 7/n

While getting fired for picking the wrong technology stack is bad, going to jail is far worse. Go ahead and say "the bill is just about making executives accountable." Sure, on the surface that is true. It's something we've been asking for in infosec for a while now. 8/n

But let me suggest that you should think about the probable ripple effects. They aren't small. They'll be felt throughout the infosec community. Before saying "make executives accountable for cybersecurity" make sure that's really what you want. 9/n

BTW, this isn't an attack on Wyden. I generally love his ideas and even this one is well intentioned. He's trying to do right by "the people" while I'm looking at the health of an industry (an erosion of which will eventually hurt the people). /fin