I am a programmer. I heard about Ccleaner security breach, I think Ccleaner is dead by now, who would trust such apps, one security breach destroyed a well known company. I guess the manager would be upset and he would fire some programmers.

What if someday I face the same scenario, and get fired. Would that destroy my CV? I guess if I'm just an employee I'd probably be able to hide it. But what if I'm a manager in such a big company, those positions are harder to hide.

Security topics are too broad and you do your best to stay safe but everyone makes mistakes. Programmers aren't ethical hackers so they don't know every hacking method. What happens to their career in these scenarios.

  • 1
    What is CCleaner and how is it relevant to your question? – Brandin Sep 22 '17 at 5:46
  • @Brandin piriform.com/ccleaner/download was hands down the best ever windows cleaner tool and had an android app too, all IT professionals used it. And then theverge.com/2017/9/21/16344696/… and arstechnica.com/information-technology/2017/09/…... As a programmer, what if a hacker destroyed my company and I was to blame – Lynob Sep 22 '17 at 9:17
  • With the CClearner story, it's possible that someone inside the company inserted the malware before release. Is that what you're asking about here? The person responsible in that scenario should be fired at minimum. Are you worried about a company's "bad press" affecting your CV after a fiaso? – Brandin Sep 22 '17 at 10:38
  • @Brandin yes assuming it wasn't an inside job, because if it's an inside job then the person who did it deserves the worst but if it wasn't an inside job and someone was blamed, what happens to his career – Lynob Sep 22 '17 at 11:22
  • I realize this is off-topic but in this particular case I have to tell you that I think of CCleaner's whole product category as nothing but adware/shovelware vectors. If you as a programmer came to me having worked at a company that produced this sort of stuff I'd look at you askance even absent this recent event. – Ernest Friedman-Hill Sep 23 '17 at 12:12

Would that destroy my CV?

No, your CV would list your prior employment as normal. It is not normal to detail why you left a position in your CV.

If you are called in for interview then you could certainly make it hard for yourself depending on how you explained why you left. Assuming that the security breach was a mistake and not intentional, then this shouldn't be hard. Employers don't in my experience automatically discount applicants who have made mistakes, particularly if they show how they have learned from the experience.

There is a story (myth?) about an IBM employee way back who made a mistake that cost the company about a million dollars. The employee figured they would be fired and met with the CEO who responded: “Fire you? I’ve just invested a million dollars in your education, and you think I’m going to fire you?”

  • 3
    The quote deserves accepting the answer and much more – Lynob Sep 21 '17 at 20:38

What if someday I face the same scenario, and get fired. Would that destroy my CV?

Hard to tell, but most probably it will affect you in some way at least, not necessarily destroy you. Surely that company will not be too willing to hire you again, and other companies in the same industry or area are likely to hear about the situation.

Besides, in cases like that it is hard to find just one culprit or responsible for the situation; usually those breaches are result of several bugs or missing features, which are also in most cases developed by a group of programmers. Finding which head to cut in this cases is more complicated, as no single person is responsible for that, but my guess would be that the manager or lead of that group may be the one taking most of the blame (not sure if this is the correct thing to do, but is something that may happen).

  • 2
    If one mistake, by one developer, can cause really bad damage maybe the real problem is in the code review and testing processes. – Patricia Shanahan Sep 21 '17 at 21:21
  • Sure thing @PatriciaShanahan , also if by some change one mistake by one developer caused damage it was also in part due to peer reviewing or testing process failing. Therefore it is not common to blame just one person. – DarkCygnus Sep 21 '17 at 21:22

I would take a wild guess to say that unless you have some malignant backdoor code or poorly structured architecture that's completely vulnerable for injection, you are safe.

It would also speak volumes depending on your position. If you are the chief architect of your software program and you did not take into account vulnerabilities / penetration testing, then that's on you. If you missed an opportunity to review code for security purposes and you got injected, that's probably the big deal but will not cause you to be homeless.

I think for us IT folks, the most important question is not only how we got hacked but what methods did we put in place in order to ensure our risk of being hacked is low. You should be able to answer this confidently without any hesitation. If you can't, then make security one of your top priorities. ASAP.

Not the answer you're looking for? Browse other questions tagged or ask your own question.