4 ms·

Sullivan in August told Reuters that his security team totaled around 500 employees. Google says Uber has more than 12,000 employees. Uber is not a typical com

Sullivan in August told Reuters that his security team totaled around 500 employees. Google says Uber has more than 12,000 employees. Uber is not a typical company, but how do other tech companies compare?

valuearb 9y ago
They probably have proportionately far fewer security employees, just far more effective ones. All snark aside, I'd guess that the vast amount of Uber security staff's role is investigating driver fraud. Uber grew so immensely fast because they offered compelling sign up inducements to drivers, and in lots of cases those were easy to game. It's why Uber got caught "fingerprinting" iPhones by Apple so they could detect whether the same phone was being used to sign up for multiple driver accounts to double dip the signup bonus programs.
- jacquesm 9y ago
  Any two sided marketplace is rife with opportunities for fraud as well as money laundering.
- greggarious 9y ago
  >All snark aside, I'd guess that the vast amount of Uber security staff's role is investigating driver fraud. I thought most companies separate out pure infosec from anti-fraud? Some orgs may house both under the bubble of risk management but there's a big difference between a security engineer and an anti-fraud analyst.
  - stickfigure 9y ago
    Since the third person mentioned in the article was "Jeff Jones, who handled physical security", I'm assuming Uber lumped anything possibly related to "security" in one org. Which does seem peculiar.
    - kenbaylor 9y ago
      You are correct. All things with even the vaguest hint of security and safety were lumped there. Antifraud, monitoring who touches which logs, being the sole provider of electronic evidence in all investigations, infosec, competitive information, investigating rapes, putting listening devices into the uber app .....very unorthodox.
dsr_ 9y ago
5 in 120 is 1 in 24. There are 30ish people at my company, and five of them are directly responsible for security and 20 or so are indirectly responsible... so I guess either we're very over-weighted or Uber is very under-weighted. But you have to look at the threat models, the value of what you're protecting, and the surface areas that you expose. Without comparing those, no useful inferences can be drawn.
- CardenB 9y ago
  Assuming it scales linearly from 30 people to 12000 people? That's a stretch.
- baby 9y ago
  Different kind of companies have different needs, a security team doesn't scale like the HR team or the finance team or the ... it's really hard to figure out how much you need to employ. And when you have breaches and things like that, is it because you didn't have enough security employees? Or is it rather because its focus was bad? Or the employees were bad? Or because the branch tasked to secure the network was bad?
brown9-2 9y ago
Be careful with comparisons here, “security” is a super broad label.

valuearb 9y ago

They probably have proportionately far fewer security employees, just far more effective ones. All snark aside, I'd guess that the vast amount of Uber security staff's role is investigating driver fraud. Uber grew so immensely fast because they offered compelling sign up inducements to drivers, and in lots of cases those were easy to game. It's why Uber got caught "fingerprinting" iPhones by Apple so they could detect whether the same phone was being used to sign up for multiple driver accounts to double dip the signup bonus programs.

jacquesm 9y ago
Any two sided marketplace is rife with opportunities for fraud as well as money laundering.
greggarious 9y ago
>All snark aside, I'd guess that the vast amount of Uber security staff's role is investigating driver fraud. I thought most companies separate out pure infosec from anti-fraud? Some orgs may house both under the bubble of risk management but there's a big difference between a security engineer and an anti-fraud analyst.
- stickfigure 9y ago
  Since the third person mentioned in the article was "Jeff Jones, who handled physical security", I'm assuming Uber lumped anything possibly related to "security" in one org. Which does seem peculiar.
  - kenbaylor 9y ago
    You are correct. All things with even the vaguest hint of security and safety were lumped there. Antifraud, monitoring who touches which logs, being the sole provider of electronic evidence in all investigations, infosec, competitive information, investigating rapes, putting listening devices into the uber app .....very unorthodox.

dsr_ 9y ago

5 in 120 is 1 in 24. There are 30ish people at my company, and five of them are directly responsible for security and 20 or so are indirectly responsible... so I guess either we're very over-weighted or Uber is very under-weighted. But you have to look at the threat models, the value of what you're protecting, and the surface areas that you expose. Without comparing those, no useful inferences can be drawn.

CardenB 9y ago
Assuming it scales linearly from 30 people to 12000 people? That's a stretch.
baby 9y ago
Different kind of companies have different needs, a security team doesn't scale like the HR team or the finance team or the ... it's really hard to figure out how much you need to employ. And when you have breaches and things like that, is it because you didn't have enough security employees? Or is it rather because its focus was bad? Or the employees were bad? Or because the branch tasked to secure the network was bad?

brown9-2 9y ago

Be careful with comparisons here, “security” is a super broad label.