Photo Credit: peetje2 via Compfight cc
Ebenezer the CEO of Scroogle.com took a sip from his Christmas blend skinny latte and slouched back in his executive chair, feet resting on the substantial mahogany desk.
The smartphone was blinking indicating a new message or voicemail(s) were present.
Let them wait thought Ebenezer. He wanted to take some time to reflect on the 2015 calendar year.
Not a bad year. Running with a few risks across the business but crucially numbers were pretty good. Although there was the unfortunate firing of Marley the last CISO earlier in the year when the security breach occurred.
We covered it up out of sight of the regulators but someone’s head had to roll and it wasn’t going to be Ebenezer, oh no sir. The CISO at the time was Marley and frankly he made the perfect scapegoat.
Hard working guy. Seventy-hour weeks were pretty normal for Marley – hardly surprising given the miserly budget Scroogle allocated to the security function. Security staff weren’t cheap these days. Some of those CVs Marley emailed him looked pretty skillful no doubt – but some of those role descriptions? Surely Marley was plucking these out of thin air; when he should have been focusing on the cloud.
Analyst? Of what? We don’t keep much log data, there isn’t the room on the SAN for heaven’s sake.
Auditor? Why? We have the annual audit for compliance sake, that should be quite enough.
And then, Ebenezer’s personal favourite… Internal Penetration Tester! From where on God’s earth did Marley pluck names?
So the requests were all declined of course. It was so easy to bat Marley’s pleas away.
“The business case isn’t robust enough, dear boy” would do it followed by denying him any follow up meetings.
And Ebenezer’s mailbox filter rule evolved over time. At the outset any mails FROM: Marley – CISO with “Risk” in the SUBJECT: field were moved to Trash and by the time of Marley’s unfortunate demise the filter had expanded to all emails originating from the CISO being removed without ever being viewed.
And then the breach happened. Or to be more specific they found something very suspicious on computers in the HR and Finance departments.
Having fielded an increasing number of complaints from users in those areas, a young bright spark named Cratchit in tech support sent a report to the board that identified unwanted persistent software on many of the systems.
“How did this happen?” demanded the rest of the board members at the emergency meeting as the CEO risked a vote of no-confidence.
There was only one thing for it, Ebenezer had to communicate clearly and show strong leadership in this crisis.
“It was Marley’s fault” he told them. “He never saw this coming or reported any risks. Incompetent – and for the money I pay him it’s not good enough. He’s already been fired” continued Ebenezer as he sent the SMS to Marley under the desk.
The next day Ebenezer promoted Cratchit to the CISO role which was great as he was on half the money that Marley had been paid. Win Win.
Ebenezer didn’t even want a CISO. What did he need a CISO for? The last audit said that the senior management of Scroogle should show commitment and support to the information security function or something like that.
Ebenezer bloody well didn’t want to talk about security when it just got in the way of his plans.
And now as the festive season was in full swing and 2015 was drawing to an end Ebenezer could rightfully claim that the leadership he had shown as CEO at the time was an outstanding display of judgement. They had sailed through the year with no more security incidents. Perhaps it really had been Marley’s fault?
As Ebenezer left for the day he strode past reception. Belle the receptionist called after him.
“Ebenezer these gentlemen have been patiently waiting to speak to you all afternoon”, she said pointing to two portly gentlemen sitting nervously on leather sofas in the waiting area.
Ebenezer glared first at the heavens and then contemptuously at the men:. “Yes?”
The men rose. “Good evening Mr Scroogle, it is truly an honour” said the less portly of the pair.
“We represent a not for profit organisation, with a mission of improving Cyber Security skills in the country – in particular in youths and those beginning their working lives. By closing the Cyber skills gap we can strengthen the economy and more importantly improve the futures of the young people who gain these skills. And the benefits for your own organisation are…..” but the portly man stopped as he realised Ebenezer wasn’t listening. He was looking and tapping away at the screen of his smartphone.
“Mr Scroogle?” asked portly man #2.
“You lost me at ‘Not for profit’ ” sneered Ebenezer and then spun around on his heels and marched out of the office leaving the portly men staring out into the cold dark night.
***********
Private message received on LinkedIn was the message Ebenezer noticed when he fired up his touchscreen Zablet.
His eyes widened when he saw who it was from.
Marley! And in his profile picture he looked terrible. Haggard, pale and his status currently awaiting next opportunity.
Ebenezer clicked the link in the message which then launched a video. Marley was in a busy bar somewhere and began talking into the camera.
“Ebeneesher” he slurred. “I’m here to tell you about 4 spiritsh.”
He’s insane thought Ebenezer.
“The firsht spirit will show you how utterly bad you’ve been in the past. The shhecond will give you a preshent. Or the spirit of Chrishmash preshent or something. The third shhhpirit will show the terrible future that awaits, if you don’t change your waysh”
“You said 4 spirits” pointed out Ebenezer in a futile gesture to a non-responsive screen which was playing a pre-recorded video.
“Oh yesh” said Marley as if he had heard.
“4th shpirit. Jack Daniels pleash” he said as he slid his glass across the bar to someone off-screen that Ebenezer presumed was the barman.
****************
Ebenezer awoke suddenly with a start. It was cold. Very cold. A distinct draft in the room was the culprit, making the curtains sway gently.
Standing at the end of his bed was a small figure with a brightly glowing screen for a head. The head was familiar.
“Hello Ebenezer” it said and he knew why it was such a familiar blast from the past. Max Headroom!
“You … you … you’re not real” stammered the CEO of Scroogle.Com.
“I’m as real as your memories old bean” replied the Ghost of Christmas Past and the screen flickered, the face fading from view to instead display Ebenezer in a boardroom with Marley. This was a much healthier looking Marley, the proud, smart and motivated Marley. Full of ideas and passion. Maybe he wasn’t such a bad bloke back then.
Marley was running through slides titled SCROOGLE.COM CYBER SECURITY STRATEGY. In the scene Ebenezer was paying no attention at all, looking intently at his smartphone – and as the picture focused in he could see it was at Facebook. He wasn’t concentrating on Marley’s efforts for Facebook.
And the ideas Marley presented were good, to be fair. A target operating model. The top 5 risks to the business. Vulnerability Management. A securing the human campaign. He had clearly taken time with this and was passionate.
And Ebenezer was paying absolutely zero attention.
The apparition suddenly vanished and the room was dark once again.
Ebenezer sat back down on his bed remorsefully and pulled up the covers. He needn’t have bothered.
The flat screen TV mounted on his bedroom wall pinged into life with the following words displayed across it:
THE GHOST OF CHRISTMAS PRESENT IS NOW OUT OF THE OFFICE UNTIL JANUARY 4TH. PLEASE WATCH THE VIDEO THAT FOLLOWS INSTEAD.
And with that the picture morphed to show Cratchit – the current CISO of Scroogle.Com – shivering and hunched over a console in a cold data centre.
“But … but … he shouldn’t be doing that on Christmas Day” protested Ebenezer.
“He’s the CISO!”
Max Headroom’s voice suddenly spoke again somewhere in his mind. “Remember how you ripped up his strategy too, dear boy?”
It was true. Despite being unqualified for the role, Cratchit had sent a meticulously crafted and bound report to the CEO outlining his requirements and needs to transform the Scroogle.Com security function.
And Ebenezer had simply told Belle to shred it. If the CEO didn’t know the risks then he didn’t have to deal with them.
Ebenezer called it The Ostrich Approach.
And now the screen changed again to show a family – Cratchit’s family – at the Christmas dinner table. The two young children asked their Mother “Why can’t Daddy be here with us Mummy?”
The Mother forlornly replied “He has to work today darlings, Daddy is worried that bad people will try to take his employer’s data and is working very hard to stop it happening. Play with your PS4 instead”.
The children sobbed, Ebenezer gulped and the screen clicked off once again.
Ebenezer heard a ringing. He picked up the Zablet.
Incoming Skype call. He pressed the green answer button.
This time another face. Bearded. Pony tailed. Greasy bad skin. Black t-shirt.
“Yo dude. I’m the Ghost and I’m your future” he said.
The screen changed and a newspaper headline spun into view.
SCROOGLE.COM HACKED BY UNKNOWN-COLLECTIVE HACKTIVIST GROUP.
Ebenezer read on horrified.
CEO CHARGED WITH CRIMINAL NEGLIGENCE FOR RECORD DATA LOSS.
The beardy face appeared again.
“Yo. We got all your customer data man. All of it. Shared it for everyone to use. We owned you man. Too easy. People like you shouldn’t be allowed to hold this kind of data.”
Ebenezer wanted to ask him why? How?
Not a man afraid to ask tough and to-the-point questions, he did.
“Why? How? Why didn’t you warn us?”
The beardy Ghost of Christmas Future cackled (more of an unhealthy wheeze really but cackled sounds better in The Christmas Carol context).
“Warn you? We did warn you dude!”
Ebenezer was bemused. Dumbfounded even.
“We told you to expect us all over Twitter man. Bulletin boards on the Dark Web. Started luring your customers to fake domains. The phishing emails were an early warning dude”
Now the Ghost of Christmas Future looked abhorred.
“I even stuck a video up on YouTube telling you we were coming man. You telling me you don’t even monitor this stuff?” he pleaded. “Dude. That’s just negligent”
Ebenezer dropped to his knees, wringing his hands. “I’ve been so terrible to my poor CISOs. I promise to change my ways from this point on!”
*****************
The alarm clock rang – ‘Money, Money, Money’ by ABBA.
Ebenezer blinked then wiped the sleep from his eyes. Had it all been a dream?
A quick look in the browser history of the Zablet and PC showed visits to the Ghosts of Christmas Future and Present. It had definitely happened.
He picked up his Smartphone and called Belle.
“Get me Tiny Tim the Security Analyst” ordered Ebenezer and then remembering his epiphany “and Happy Christmas to you and your family Belle, take the rest of the day off and get them all lunch – bring me the receipt!”
A very nervous Tiny Tim called next.
“Get yourself the biggest, plumpest SIEM you can” instructed Ebenezer in almost evangelical tones.
“And a Vulnerability scanner! And a Threat Intelligence tool! In fact, get all of them! And lots of APT mitigation tools! Happy Christmas Tiny Tim!”
Ebenezer ran out into the cold crisp Christmas morning, leapt into his 4×4 (with the CEO 1 personalised numberplate) and set the SatNav for the Data Centre.
Once there he found Cratchit, slumped over next to a server rack, clutching a picture of his family in his dry, cracked, frozen hand.
Ebenezer panicked. He was too late!
“CRATCHIT! CRATCHIT! Wake up!” he implored, desperately trying to shake life into the poor CISO’s lifeless, freezing body.
Cratchit groaned and slowly opened his eyelids. When he saw it was his CEO he groaned again and closed them.
“CRATCHIT!” shouted Ebenezer again. “You can have it all! Consultants! Analysts! Auditors! Operational Managers! Penetration Testers! Have 10 of each!”
The CISO’s eyes opened up again, this time brighter.
“All of them?” he asked.
“Yes my dear Cratchit, ALL OF THEM!”
A smile creased across Cratchit’s lips.
“And a massive wage rise!” continued Ebenezer.
“I’ve already told Tiny Tim to blow the budget on Security toolsets! It’s Christmas!!!!”
He helped Cratchitt to his feet and the pair of them walked out, arms over each other’s shoulders, a CEO and CISO newly joined together, united by Christmas and the future of Scroogle.Com.
Somewhere behind them one of the screens in the Data Centre flickered on. A beardy, greasy face appeared, resplendent in black t-shirt.
“Dude! Dude! I think you’ve gone too far the other way now…….”
THE END
