Security expert Robert 'RSnake' Hansen proposes a CISO code of ethics to address self-dealing, kickbacks, and conflicts of interest in the role. The discussion covers specific ethical guidelines including mandatory disclosure of all vendor compensation, recusal from conflicted purchasing decisions, documentation of vendor evaluations, and a controversial provision barring CISOs from advising foreign security companies due to national security risks. Hansen shares anecdotal evidence of kickback schemes ranging from tens of thousands to millions of dollars, shelf-ware purchases, and no-show consulting arrangements. The most contentious proposal — restricting CISO advisory roles to domestically-based companies — drew significant pushback from the cybersecurity community, which ultimately discouraged Hansen from advancing the initiative further.
