Chapter Eleven: Damage

Friday, June $29,9$:$12$ a$.$m$....$

$$You$$re recommending that we shut down the entire business for how many days?$$ Carl Williams did not conceal his incredulity.

$$Not the entire business,$$ said Barton, $$just parts of it$,$ for three or four days total, which, if we did it on a weekend, interrupts the business only a couple of days. And I$$m not yet saying

we should do it$.$ It$$s one of several options already identified.$$ Barton wondered if he$$d been too forthcoming in laying out for Williams everything known about the event so far. Wrong way to brief the CEO, thought Barton, or this CEO, anyway. He made a mental note. He hadn$$t had much time to think through the finer points of how he$$d present to Williams, who had yanked him out of a meeting with his IT team.

$$One of several options,$$ repeated Williams.

$$Yes$.$

$$The one that most of your staff prefers,$$ he said.

Barton squirmed. $$That$$s right. At the moment.$$

Barton recalled the last time he$$d been this uncomfortable in this chair: the day Williams had sprung the new CIO job on him. Barton now wondered if his boss might be about to take that job back. Barton wasn$$t far from just handing it over. He hadn$$t slept very well the night before. As in that earlier meeting, the CEO now stared out the window, refusing to sit. Barton, on the other hand, was captive in a chair that suddenly reminded him of an interrogation seat, behind a table that had become unnecessarily long. He wanted desperately to get back downstairs; he needed more time with his team, to help them come up with a full slate of options.

At that moment, Barton could see the attraction in spending most of his time downstairs. As he looked at Williams, he was pretty sure the CEO would be happy never to have to talk about IT again. Probably, Barton realized, Williams had slept badly also.

$$Carl$,$ Barton said, seizing the initiative and succumbing to an irresistible urge to get on with doing something, anything, $$let me get back to you in a couple of hours with all the options. We still have more work to do before we can make a real recommendation.$$

$$I thought you just made one,$$ said Williams.

Moments before, Barton had said that shutting down the business was not yet a recommendation. Now the CEO had, Barton assumed, moved on to expressing frustration. It would be a bad idea to respond in kind. Instead, Barton opted for calm: $$No$,$ Carl, what I just gave you was an update. I let you know some of the options we$$ve been discussing. I especially wanted you to know about theleast palatable option we$$ve considered. I thought letting you know of that possibility now was preferable to surprising you with it later.$$

Williams turned toward Barton and nodded. Barton could see that he had scored points with these words, though not nearly enough to make up for the points he had lost in the last twenty$-$ four hours.

$$Nice job on the analyst meeting, by the way,$$ Williams said. $$There was no discernible impact on the stock price yesterday afternoon. We$$ll see when the market opens in a few minutes, but my guess is that you navigated that minefield successfully.$$

More points scored, Barton thought. $$I think so too,$$ he said. Gordon$$s team had suggested playing it cool at that meeting, not even bringing up the attack unless someone else did. If it came up at all, Barton was to acknowledge it$,$ note that denial of service attacks are extremely common, and that the company$$s security measures had handled the attack after a short delay.

During the meeting, Williams and Graham Wells called in and listened, not letting any of the analysts know they were present.

At one point during the meeting, also at his team$$s suggestion, Barton had laid the groundwork for future security measures, including a possible company shutdown, by reemphasizing the firm$$s commitment to security. $$We think we$$re in pretty good shape,$$ Barton had told analysts, $$but$,$ as the new guy, I can$$t rule out taking some very significant additional steps$$including steps that might, say, shut us down for three or four days, for a maintenance outage$$to reach a higher standard of service for our customers.$$

$$Williams would go for that?$$ asked one of the analysts.

$$Yes$,$ said Barton, $$I believe that he would, if I recommend it$.$ Although,$$ he added, $$we don$$t have reason at the moment to think that would be necessary. I just don$$t want you guys to be surprised if we decide to do something like that.$$

Barton had added that last part mostly for the benefit of the lurking Williams, who at that time had not heard about any options involving a company shut down. But it was an effective moment in the meeting. It conveyed to analysts that the CEO entrusted much to his new CIO. Barton couldn$$t help wondering whether this was a past, more than present, situation.

He$$d stuck to a general line of argument throughout the meeting: $$We$$re in good shape already, but we want to be even better.$$ The question he had dreaded$$Do you have any reason to believe tod