What people want to highlight is that this woman's only qualification is being a music major. She has literally no experience in managing the security of hundreds of millions of people's private information. For a company handling such huge amounts of such sensitive data, the CSO should possess exceptional credentials in the security community. She clearly does not.
Combine this with the facts that we know are correct (Equifax has terrible data security and response), and the music major qualification becomes a big red flag.
When sexual harassment allegations against Uber executives surfaced, didn't we put a lot of blame on the CEO for letting such a work-culture thrive? The same is applicable here on the CSO, and the CEO for hiring a woman whose sole achievement is a music degree.
E.g. http://www.marketwatch.com/story/equifax-ceo-hired-a-music-m... talks about her non-degree experience with one sentence:
> To play devil’s advocate, Mauldin does at least have 14 years’ private-sector experience since getting her degrees.[...] The question is how far any of this can take you in this field if you don’t have a formal education in technology.
Pointing out to the general public that this alone is not unusual in the field is IMHO important context. And it's not like the article is trying to argue that she was good at her job, just that you can't derive much information from the pure fact what degree someone has.
C-Level is amongst other things, a strategic and political position.
After an incident like this, it is understandable that people look at the profile of those entrusted with this responsibility.
If we look at Moxie's OSINT, we'd quickly see that he was perfectly qualified based on his presence in the ecosystem (conference talks etc).
A more suitable comparison would be the CSO of Equifax's competitor - which is Experian.
Do the same comparison with their CSO:
- Director of Security / Compliance,Capital One
- VP of Information Security, Citi Group
- Director Information Security and Risk Management, Thomson Reuters
- Director / CSO, Experian
Whilst I think the education is relevant, I don't think it is the defining factor... But.. We should be careful to jump to "education doesn't matter".
Was this the right person to be entrusted with the strategy for OUR data security? We simply don't know... but what we have seen has caused concern.
The full title is "Equifax’s security chief had some big problems. Being a music major wasn’t one of them."
And the article is entirely about that 2nd part... that her degree in music shouldn't be an issue.