4 ms·

Hopefully, most folks buying "cybersecurity" consulting know to use boutiques for legitimate assessment work. Quality using a big 4 is extremely variable. Many

Hopefully, most folks buying "cybersecurity" consulting know to use boutiques for legitimate assessment work. Quality using a big 4 is extremely variable. Many of my customers have told me this over the years. They do have good people, but actually getting one of their few decent folks on your project is hard. Hits close to home though. Anyone can get owned. Even elite teams and individuals have had their email compromised. (Matasano, Kaminsky). Everyone make sure your users have and use good 2 factor authentication. Make sure you don't keep much sensitive data on your email servers. Encrypt sensitive documentation in email. Have sane retention policies (1-2 months max on a cloud server). Lock down your admin accounts. Kick out all the old accounts completely. Take the time to talk with each person at your company about email security and suspicious emails. Especially administrative and HR staff. Of the deep penetrations into orgs I know of a high percentage happen thru email. Oh and do some internal phishing, FWIW. It's good to get discussions rolling and get everyone's attention.

wiz21c 9y ago
>> Hits close to home though. Anyone can get owned. Even elite teams and individuals have had their email compromised. (Matasano, Kaminsky). Of course, I was a bit cynical. But the kind of statements I see on their website are just too much.
UK-AL 9y ago
I think Big4 Cyber security tends to be more policy based. What ACLS should be set. Who should get what access. etc Boutiques to tend be more hardcore technical, breaking into applications.
- bitexploder 9y ago
  A lot of their "cybersecurity" revenue does indeed stem from advisory and risk assessment oriented work. They still have technical teams of varying quality that perform "penetration testing", though. Often the follow up and methodology for any risk assessment is to leave an executive with strategic recommendations. Many of these recommendations are the actual technical work. No way a Big 4 sends technical, even heavily technical, work to some other firm. They just say, "yes, we do that". It is the same with any assessment or consulting. We always try to leave recommendations, strategic and tactical, which advise them on next steps. Often, those next steps involve us helping them with more assessment work, directed at the most security sensitive areas to maximize usage of often limited security budgets. What will get them hacked next, basically. Smaller firms with more technical staff definitely shy away from risk assessment and compliance work because it is, honestly, repetitive and boring. But, it also drives a tremendous amount of hard technical work into any firm because if you can't sell someone a pen test or technical assessment after doing advisory work you aren't very good at things. Sorry if that sounds cynical or like "everyone needs more of our services and pen testing", but that is the model. It is also why boutiques exist. We don't just give brain dead "yep, you need pentesting, and it is going to be expensive" recommendations. We tailor it and focus on what the customer actually wants/needs. Whereas, a big4 tends to rotate consultants and lose knowledge unless it is staff aug. The relationship and understanding engineer teams really matters when you want to do the most interesting assessment work AND provide value to the customer and not just "sell them pen tests" :)

wiz21c 9y ago

>> Hits close to home though. Anyone can get owned. Even elite teams and individuals have had their email compromised. (Matasano, Kaminsky). Of course, I was a bit cynical. But the kind of statements I see on their website are just too much.

UK-AL 9y ago

I think Big4 Cyber security tends to be more policy based. What ACLS should be set. Who should get what access. etc Boutiques to tend be more hardcore technical, breaking into applications.

bitexploder 9y ago
A lot of their "cybersecurity" revenue does indeed stem from advisory and risk assessment oriented work. They still have technical teams of varying quality that perform "penetration testing", though. Often the follow up and methodology for any risk assessment is to leave an executive with strategic recommendations. Many of these recommendations are the actual technical work. No way a Big 4 sends technical, even heavily technical, work to some other firm. They just say, "yes, we do that". It is the same with any assessment or consulting. We always try to leave recommendations, strategic and tactical, which advise them on next steps. Often, those next steps involve us helping them with more assessment work, directed at the most security sensitive areas to maximize usage of often limited security budgets. What will get them hacked next, basically. Smaller firms with more technical staff definitely shy away from risk assessment and compliance work because it is, honestly, repetitive and boring. But, it also drives a tremendous amount of hard technical work into any firm because if you can't sell someone a pen test or technical assessment after doing advisory work you aren't very good at things. Sorry if that sounds cynical or like "everyone needs more of our services and pen testing", but that is the model. It is also why boutiques exist. We don't just give brain dead "yep, you need pentesting, and it is going to be expensive" recommendations. We tailor it and focus on what the customer actually wants/needs. Whereas, a big4 tends to rotate consultants and lose knowledge unless it is staff aug. The relationship and understanding engineer teams really matters when you want to do the most interesting assessment work AND provide value to the customer and not just "sell them pen tests" :)