Equifax moved the IT security team out from under IT due to "fundamental disagreements." This is highlighted as a shortcoming in the report, but infosec shouldn't be under IT. Imagine if your internal audit group were subordinate to the group it was auditing. 1/n 
The report goes on to discuss moving infosec back under IT. Again, in the vast majority of cases this is the wrong answer. If we are all holding hands around the campfire, then maybe this works. In the real world, it only works when the right personalities are in place. 2/n
This is why we need subject matter experts writing these reports. During the testimony, Committee members became fixated on the fact that IT and infosec were in different orgs. They then drew inferences from the fact that IT referred to infosec for answers (and vice versa) 3/n
But shouldn't we expect this? Infosec performs two major work roles for an organization: architecture and audit. Architecture helps IT design secure systems and audit helps find issues (both through periodic testing and real time monitoring). 4/n
The whole Enron event went down because Enron was in bed with their auditors. It's hard to not see where the corporate organizational structure recommended in this report can go very wrong. I've seen it first hand (repeatedly). 5/n
This portion of the report claims that separating IT and infosec created an "accountability gap." It created a distribution of work, but each team was "accountable" for its own work roles. Obviously communication between groups was a serious issue. We shouldn't downplay that. 6/n
What I read here is that Equifax, like so many other firms we've worked with for incident response, had a toxic relationship between IT and infosec. Combining the groups does nothing to fix your culture problems. I've seen it tried - without replacing leadership, it fails. 7/n
There's a lot of great information in the report that's never been publicly available (at least not in this format). But there are big misunderstandings in this report too. I believe the root cause is that non-SMEs are interpreting complex topics without true understanding. 8/8
