4 ms·

I'm not really sure wtf KPCB was thinking here. NSA isn't exactly the world's top defensive security organization. As a red-team, I could see some value in ex

by rdl 11y ago

I'm not really sure wtf KPCB was thinking here. NSA isn't exactly the world's top defensive security organization. As a red-team, I could see some value in ex-NSA, but for commercial information assurance (IA), aside from "we've seen how things are done badly, by contractors", I would consider NSA experience not just irrelevant but negative. In addition to being ineffective at the IA mission, NSA has entirely unreasonable resources and imposes constraints on their users. These would be unavailable for commercial companies, so NSA IA experience is even less helpful. I could sort of see putting $XX mm into a company for "halo effect" on your other investments, but in this case there are more than enough negative external optics which come with the decision. I personally would not want to be associated via common investor with this. (maybe should post as a throwaway, but w/e; I stand by this)

tdaltonc 11y ago
What are the worlds top defensive security organizations?
- rdl 11y ago
  Google is pretty high up there. For a commercial enterprise, they'd be my largest, most accessible hiring/investment pool. "Developed and implemented X meaningful control at Google" is close to auto-investable, IMO. There are some pharma (drug discovery) and prop-trading firms I'd respect highly, too. Not high street banks but smaller or more focused entities. Knowing which is hard. For big companies which are "obviously" good: Apple's not bad internally. FB, Amazon, Microsoft aren't bad. The hard part is identifying who is good internally out of large teams. (Yahoo! has also traditionally had good infosec relative to everything else, although perhaps sacrificed business to it.) LV casinos as a sector seem to be ok. For harder bets: There are few tougher environments today than the bitcoin ecosystem. A lot of those companies are shitshows staffed by people with zero infosec background, but there are exceptions. Also of course some of the most elite consultancies (iSEC, IOActive, Cylance, etc.) have great people. There are individual good people in large big-N consultancies too, but as a blanket statement, not as good to recruit from. (For offense: Israel/8200/etc. are probably the best recruiting pool, due to cost relative to skill. There are good people in the NSA ecosystem as well, for offense, although largely contractors, and expensive. I don't buy that extreme competence at actually implementing widely-known-but-we-didnt-think-people-would-actually-go-that-far vulnerabilities makes you a stronger defensive player, though; developing fundamentally new attacks, or finding vulnerabilities, sure, but spending $5b to do the attack everyone had identified as a possibility is just an engineering and economic exercise.) (In SV today, startups in security are probably the best pool of talent, hence acquihire. I probably know a pool of ~200 good to great people in the general security ecosystem at any given time from a bunch of companies who are recruitable or buyable.)
  - samstave 11y ago
    FB has had somewhat of a revolving door with NSA security, though [0] -- so given your negative perception of this, how do you feel about what FB does and the NSA does that overlap enough to have employees come/go between the two? http://www.thewire.com/technology/2013/06/facebooks-former-security-chief-now-works-nsa/66432/ http://www.thewire.com/technology/2013/06/facebooks-former-s... Old -- but there are other articles about it as well...
    - tptacek 11y ago
      By "revolving door" you appear to mean that one executive, who hadn't previously worked for NSA, left Facebook for a job at NSA. It would be hard to imagine more prominently anti-NSA security executive than Alex Stamos, their current CSO.
      - samstave 11y ago
        My understanding was that an NSA employee came to FB, then left FB to go back to NSA.. I could be totally incorrect though...
- linkregister 11y ago
  Etsy, of all organizations, is considered to be one of the best. It has the most rigorous security measures in a usable internet-connected network I've ever heard of. And the ones listed by @rdl.
  - bruu_ 11y ago
    Are you joking? Not trying to be critical, I just can't tell if you're serious. Why would Etsy have the most rigorous security measures?
    - rdl 11y ago
      They had (have?) a security team entirely larger and more competent than I'd expect (or, honestly, really choose to seek to have) in an org their size. I think they were just lucky to get a couple great people early on and doubled down.
    - TeMPOraL 11y ago
      Etsy is a weird case. I'd never, ever have thought there's so many such good people in a company that initially seemed to me to be a random eBay-like store for selling trinkets. And yet, it turns out they have serious talent and post a lot of very interesting tech stuff.
    - tptacek 11y ago
      They aren't joking. How? Because they went out of their way to hire very good appsec people to build their team. There's a geography and right-place right-time element to what they did, too. They're a pretty good case study for how the right senior hires at the right time can set the tone for a security organization for many years after those people leave.
linkregister 11y ago
You mean that it's not reasonable to expect users to do all their work on an air-gapped system, and wait in line for the one internet-enabled terminal in the office? ;)
- rdl 11y ago
  Or the 1-3y pre-employment background screening, involving things which would be illegal for a private employer.
  - epoxyhockey 11y ago
    And the results of the background screening subsequently being sent to China via a cyber security breach.
- TeMPOraL 11y ago
  While at the same time all rats in HVAC vents go crazy because of the ultrasonic noise of a mesh network created out of employees' pwned smartphones.
vasundhar 11y ago
You seem to undermine the power of network
rdtsc 11y ago
I would guess for a start-up to be successful it is not necessarily to have a market, a good idea, a product etc. But to find a investor dumber than they are to bankroll them. NSA name sounds important, cool, and carries powerful connotations. I bet even if he said he is making flux capacitors, he'll find some investors to throw a few millions his way.
- austenallred 11y ago
  I have a feeling you and I would define "success" differently.

by rdl 11y ago

tdaltonc 11y ago

What are the worlds top defensive security organizations?

rdl 11y ago
Google is pretty high up there. For a commercial enterprise, they'd be my largest, most accessible hiring/investment pool. "Developed and implemented X meaningful control at Google" is close to auto-investable, IMO. There are some pharma (drug discovery) and prop-trading firms I'd respect highly, too. Not high street banks but smaller or more focused entities. Knowing which is hard. For big companies which are "obviously" good: Apple's not bad internally. FB, Amazon, Microsoft aren't bad. The hard part is identifying who is good internally out of large teams. (Yahoo! has also traditionally had good infosec relative to everything else, although perhaps sacrificed business to it.) LV casinos as a sector seem to be ok. For harder bets: There are few tougher environments today than the bitcoin ecosystem. A lot of those companies are shitshows staffed by people with zero infosec background, but there are exceptions. Also of course some of the most elite consultancies (iSEC, IOActive, Cylance, etc.) have great people. There are individual good people in large big-N consultancies too, but as a blanket statement, not as good to recruit from. (For offense: Israel/8200/etc. are probably the best recruiting pool, due to cost relative to skill. There are good people in the NSA ecosystem as well, for offense, although largely contractors, and expensive. I don't buy that extreme competence at actually implementing widely-known-but-we-didnt-think-people-would-actually-go-that-far vulnerabilities makes you a stronger defensive player, though; developing fundamentally new attacks, or finding vulnerabilities, sure, but spending $5b to do the attack everyone had identified as a possibility is just an engineering and economic exercise.) (In SV today, startups in security are probably the best pool of talent, hence acquihire. I probably know a pool of ~200 good to great people in the general security ecosystem at any given time from a bunch of companies who are recruitable or buyable.)
- samstave 11y ago
  FB has had somewhat of a revolving door with NSA security, though [0] -- so given your negative perception of this, how do you feel about what FB does and the NSA does that overlap enough to have employees come/go between the two? http://www.thewire.com/technology/2013/06/facebooks-former-security-chief-now-works-nsa/66432/ http://www.thewire.com/technology/2013/06/facebooks-former-s... Old -- but there are other articles about it as well...
  - tptacek 11y ago
    By "revolving door" you appear to mean that one executive, who hadn't previously worked for NSA, left Facebook for a job at NSA. It would be hard to imagine more prominently anti-NSA security executive than Alex Stamos, their current CSO.
    - samstave 11y ago
      My understanding was that an NSA employee came to FB, then left FB to go back to NSA.. I could be totally incorrect though...
linkregister 11y ago
Etsy, of all organizations, is considered to be one of the best. It has the most rigorous security measures in a usable internet-connected network I've ever heard of. And the ones listed by @rdl.
- bruu_ 11y ago
  Are you joking? Not trying to be critical, I just can't tell if you're serious. Why would Etsy have the most rigorous security measures?
  - rdl 11y ago
    They had (have?) a security team entirely larger and more competent than I'd expect (or, honestly, really choose to seek to have) in an org their size. I think they were just lucky to get a couple great people early on and doubled down.
  - TeMPOraL 11y ago
    Etsy is a weird case. I'd never, ever have thought there's so many such good people in a company that initially seemed to me to be a random eBay-like store for selling trinkets. And yet, it turns out they have serious talent and post a lot of very interesting tech stuff.
  - tptacek 11y ago
    They aren't joking. How? Because they went out of their way to hire very good appsec people to build their team. There's a geography and right-place right-time element to what they did, too. They're a pretty good case study for how the right senior hires at the right time can set the tone for a security organization for many years after those people leave.

linkregister 11y ago

You mean that it's not reasonable to expect users to do all their work on an air-gapped system, and wait in line for the one internet-enabled terminal in the office? ;)

rdl 11y ago
Or the 1-3y pre-employment background screening, involving things which would be illegal for a private employer.
- epoxyhockey 11y ago
  And the results of the background screening subsequently being sent to China via a cyber security breach.
TeMPOraL 11y ago
While at the same time all rats in HVAC vents go crazy because of the ultrasonic noise of a mesh network created out of employees' pwned smartphones.

vasundhar 11y ago

You seem to undermine the power of network

rdtsc 11y ago

I would guess for a start-up to be successful it is not necessarily to have a market, a good idea, a product etc. But to find a investor dumber than they are to bankroll them. NSA name sounds important, cool, and carries powerful connotations. I bet even if he said he is making flux capacitors, he'll find some investors to throw a few millions his way.

austenallred 11y ago
I have a feeling you and I would define "success" differently.