Training & Security Leadership
Axing Security Clearance Will Undermine Talent Pipeline, Chill Vendor Collaboration
SentinelOne’s acquihire of inaugural CISA Director Chris Krebs through a $13.9 million buyout of his nascent consulting business was a canny move – at the time when it occurred, 18 months ago. Now, through no fault of Krebs and due to an unprecedentedly vindictive U.S. president, it’s not anymore.
See Also: Live Webinar | Resilience in Crisis: Rebooting Your Minimum Viable Company Fast
The Silicon Valley-based endpoint security provider took on Krebs and former Facebook Chief Security Officer Alex Stamos to launch a strategic risk analysis and advisory group. Krebs was named SentinelOne’s chief intelligence and public policy officer, thanks to his public service and lengthy rolodex.
President Donald Trump on Wednesday signed a presidential memorandum revoking any active security clearance held by Krebs and suspending security clearances held by other individuals at SentinelOne pending a review of whether such clearances are consistent with the national interest.
“Refusal to grant certain certifications or clearance by one government agency, or decision by one government agency that our products do not meet certain standards, may cause reputational harm and cause concern with other government agencies,” SentinelOne wrote in a March regulatory filing. “The occurrence of any of the foregoing could cause government organizations to delay or refrain from purchasing our solutions.”
Krebs was the first ever director of the Cybersecurity and Infrastructure Security Agency from November 2018 to November 2020, when he was fired by Trump for refuting baseless claims of election fraud in an election won by Joe Biden. Trump said the decision to strip Krebs of his security clearance is due to Krebs “inappropriately and categorically dismissing widespread election malfeasance and serious vulnerabilities with voting machines.”
SentinelOne said less than 10 of the company’s 2,800 employees hold a security clearance, meaning the suspension of said clearances isn’t expected to materially impact the company’s business. These clearances have been obtained only where required by existing government processes and procedures to secure government systems. Still, SentinelOne’s stock is down nearly 8% since Trump’s action (see: Trump Retaliates Against Former Cybersecurity Chief).
Despite Krebs’ storied history and stellar reputation among peers, Trump’s decision has been met by radio silence. Reuters on Thursday contacted 36 cybersecurity vendors and organizations for comment on Trump’s actions against SentinelOne, and only one – the Washington-based Cyber Threat Alliance – responded, with President Michael Daniel saying the White House Memo carried numerous falsehoods.
“Targeting a company because the president does not like someone in the company is an example of the very weaponization of the federal government the memo claims to be combating,” Daniel told Reuters.
What Trump’s Decision Means for the Cyber Industry
Companies might start thinking twice about hiring cybersecurity professionals who held government roles, especially if they were part of a previous administration or made high-profile decisions, a security veteran told Information Security Media group. Companies not hiring ex-government talent due to fear of backlash and people avoiding government service because of long-term career risk would hurt America.
“It raises the question in terms of, ‘Is there more?'” the industry veteran told ISMG. “At a time when you need to be leading in finding out how to go faster, this creates uncertainty. That is not a good thing.”
Security clearances are mission-critical in cybersecurity roles that require access to classified threat intelligence, tactics and coordination with federal agencies, and revoking a clearance removes a person from being able to operate. Clearances enable people to access data essential to stopping or responding to cyber incidents, and if that access is blocked, the person or team could become largely ineffective.
“They are very important because it provides you with access the information that is essential to doing the job,” the veteran said. “And if you can’t access the information, then you can’t do the job, or you’ve got to find other people who are classified. We need frictionless collaboration between industry and government if we’re going to prevail in this cyber conflict, and this just feels like sand in the gears.”
The revocation of Krebs’ security clearance came less than a week after Trump fired U.S. Air Force Gen. Timothy Haugh – director of the National Security Agency and head of U.S. Cyber Command – for alleged disloyalty to the president. By targeting Krebs and Haugh, the Trump administration sent a message that highly competent and loyal professionals can be punished for misalignment with political narratives.
“It just has a chilling impact at a time when we need our best and brightest to step forward,” the veteran said. “This just is a reason to give people pause. People will want to step in to do the right thing, to help secure their country. And the question is, ‘Am I stepping in to secure my country, or am I stepping into a political quagmire?'”
With Haugh heading for the exits and Krebs losing his security clearance, it’s only a matter of time before the next domino falls. How much collateral damage the next move will inflict on the cybersecurity industry and our country at large is anybody’s guess.