5 ms·

As a security consultant, it makes me sad that the criteria for "taking security seriously" is as low as just "having an entire team dedicated to ... security".

As a security consultant, it makes me sad that the criteria for "taking security seriously" is as low as just "having an entire team dedicated to ... security". Every company should have a team (or depending on size, at least a person) dedicated to the security of software and infrastructure. Even the most traditionally slow-moving companies these days have security teams. If you do not have this, you are behind and are laughably unprepared for the modern age. I wish the public would start recognizing this and publicly shaming companies that don't take security seriously.

Cyph0n 9y ago
I agree, but I think you overestimate: (1) how many companies actually care about security and (2) how recent this security-focused movement among large companies is. Furthermore, Cisco deals with security problems that few other companies worry about, such as the wide-scale availability of counterfeit devices and convincing foreign customers that their devices are backdoor-free.
- qubex 9y ago
  (3)What small firms’ margins of contribution allow, given the competition in their markets. I for example run a family business that operates in the paint sector in Italy, and you’d be horrified by how compressed margins are (and have become over the past five years of debt crisis and economic recession). There’s always this aura that a rational firm can arbitrarily add structural (HR) costs to defer some nebulous, future “risk”, but in my experience this is not the case (anymore). Competition is so hardscrabble and survival is such a luxury that pretty much everybody is not only willing but obliged to skimp on everything. Being “with the times” simply isn’t an option, sadly.
brianwawok 9y ago
> Every company should have a team (or depending on size, at least a person) dedicated to the security of software and infrastructure. Two competitors in a space. One has 3 developers and 1 security guy, the other has 4 developers. In 99/100 outcomes, all else being equal, the 4 developer guy will add more features and outpace the other team and win the market. Security is an overhead and a drag on company resources.. until it's not. But how many startups fail due to lack of a security team? I cannot think of any from my RL network. I am sure some exist... but otherwise, this is the same as most "safety" measures... unimportant until it is really important.
- bproven 9y ago
  Mainly b/c there are no real downsides/penalties to leaking data (or PII) - you say "sorry" and just move on. Sometimes with an increased stock price - see Equifax :(
  - reaperducer 9y ago
    Depends on the industry. In some heavily-regulated industries, there are huge fines at stake for leaking information. Look at healthcare. If information leaks, it has to be reported to the feds within 24 hours of initial discovery. Not C-level finding out, but whatever low-level employee finds it. Even if it's one person. If it's more than around 10 people, there's a federal requirement to report it to the local media.
    - bussierem 9y ago
      >In some heavily-regulated industries I think the fact that this doesn't apply to "the people storing our credit and SSN information" is just about the apex of stupidity.
    - txcwpalpha 9y ago
      I used to work specifically in the healthcare space doing cleanup work for companies that had been recently breached. I think "huge fines" is quite an overstatement. The largest HIPAA fine in history for a data breach was for the Anthem hack, which was a leak of ~80 million records and Anthem was fined $115 million. That's no small number, but at the end of the day it's still only less than 5% of their yearly net income. And Anthem is a huge outlier: the second largest HIPAA fine in history was only ~$6 million. It's not exactly a huge deterrent for companies that want to ignore security. In terms of the public exposure, you'd probably be surprised at how many healthcare insurers/providers have data breaches but you never hear about them because these companies know how/when to report it so that it ends up nothing more than a footnote on the back page of the local paper.
- derefr 9y ago
  > But how many startups fail due to lack of a security team? Crypto exchange startups, for a big, glaring example. They’re an exception in a lot of ways, though.
caymanjim 9y ago
In a large company, a company with sufficiently-sensitive data (where loss is a legal matter), or a company with a lot of money to lose (financial processing), having a dedicated security team might make sense and might be worth the money, but in most situations, I think it does more harm than good. Security teams rarely know how applications work, so their approach to security is heavy-handed and provides a false sense of protection. It's more important to instill everyone with security-minded philosophy, so that applications and systems are designed with security in mind from the beginning. Firewalls, packet inspection, virus scanning, and the like would all be completely unnecessary if code was written securely and if human beings behaved properly. Of course these things don't happen, and of course firewalls and scans and the like are common-sense protections, but most data loss is caused by poorly-designed applications which run in very secure environments. Dedicated security teams simply aren't in a position to identify and solve problems like buffer overruns or SQL injection.
- pbhjpbhj 9y ago
  >Security teams rarely know how applications work, // I'm amazed if anyone working in a computer security role doesn't know about SQL injection attacks and their mitigations. You'll be telling me they don't know about salting passwords next??
  - taway1929293 9y ago
    Where I work, yes, the security teams don't know how applications work. we have a dedicated security team - they run nessus scans for compliance and network scans and hand them to managers and executives who hand them to us. they explicitly don't touch the code - a senior guy has declared that he's not responsible on that level, that he's 'no coder' in response to a shell injection vulnerability. so he knows 'about' salting passwords but he probably couldn't verify if they are salted or not. To me it's left the impressions that 1) security is mostly theater and 2) 'security engineer' is a meaningless title - it can mean anything from 'runs scans' to 'network administrator' to 'penetration tester' to 'good engineer'. unfortunately my default attitude towards the title has been "i'm probably dealing with a charlatan"
cookiecaper 9y ago
I'm going to disagree on the basis that segmenting your security personnel creates a lot of difficult social dynamics. However the model is structured, "security" becomes a pain point, and no one wants to see the security guy coming around the corner. The default interpretation (which is basically the only one that counts) is that this guy is coming around, tearing down _your_ work, and making you look bad in front of everyone, and what does he even know about this thing? Some people will chicken out, not press the matter, and then the "security people" are just the fall guys, unable to do anything other than take the blame for the other peoples' screw-ups. In my experience, a lot of internal security people end up stuck in that position whether they're trying to fight the good fight or not. The dynamic is similar to the corrosive POV that sees "dev" and "ops" as orthogonal concerns to segment out, and we all know how well that's gone over. Anyone looking forward to hearing all about "DevSec" in the next 10-15 years, once some startup finds a way to put a cute icon on it and gets a big pile of investor money to burn (cf. Docker)? Rather than create a tense segmentation, it's better to just hire competent developers who know security well from the get-go. Maybe they can rotate weeks doing security reviews or something like that. I don't know, I don't really have a good solution. I just know that making someone the enemy by labeling them "security personnel, here to block your deploys, tell you you're doing your job wrong, and generally just embarrass you in front of your peers and superiors" is not going to help much.
ggg9990 9y ago
Companies won’t take security seriously until 1) customers demand methods of evaluating the security of a company and making purchasing decisions accordingly — “size of security team” doesn’t count, and 2) sufficiently punishing companies that cause user harm through security failures, i.e. forcibly liquidating Equifax and confiscating all senior executives’ assets including their house.

Cyph0n 9y ago

I agree, but I think you overestimate: (1) how many companies actually care about security and (2) how recent this security-focused movement among large companies is. Furthermore, Cisco deals with security problems that few other companies worry about, such as the wide-scale availability of counterfeit devices and convincing foreign customers that their devices are backdoor-free.

qubex 9y ago
(3)What small firms’ margins of contribution allow, given the competition in their markets. I for example run a family business that operates in the paint sector in Italy, and you’d be horrified by how compressed margins are (and have become over the past five years of debt crisis and economic recession). There’s always this aura that a rational firm can arbitrarily add structural (HR) costs to defer some nebulous, future “risk”, but in my experience this is not the case (anymore). Competition is so hardscrabble and survival is such a luxury that pretty much everybody is not only willing but obliged to skimp on everything. Being “with the times” simply isn’t an option, sadly.

brianwawok 9y ago

> Every company should have a team (or depending on size, at least a person) dedicated to the security of software and infrastructure. Two competitors in a space. One has 3 developers and 1 security guy, the other has 4 developers. In 99/100 outcomes, all else being equal, the 4 developer guy will add more features and outpace the other team and win the market. Security is an overhead and a drag on company resources.. until it's not. But how many startups fail due to lack of a security team? I cannot think of any from my RL network. I am sure some exist... but otherwise, this is the same as most "safety" measures... unimportant until it is really important.

bproven 9y ago
Mainly b/c there are no real downsides/penalties to leaking data (or PII) - you say "sorry" and just move on. Sometimes with an increased stock price - see Equifax :(
- reaperducer 9y ago
  Depends on the industry. In some heavily-regulated industries, there are huge fines at stake for leaking information. Look at healthcare. If information leaks, it has to be reported to the feds within 24 hours of initial discovery. Not C-level finding out, but whatever low-level employee finds it. Even if it's one person. If it's more than around 10 people, there's a federal requirement to report it to the local media.
  - bussierem 9y ago
    >In some heavily-regulated industries I think the fact that this doesn't apply to "the people storing our credit and SSN information" is just about the apex of stupidity.
  - txcwpalpha 9y ago
    I used to work specifically in the healthcare space doing cleanup work for companies that had been recently breached. I think "huge fines" is quite an overstatement. The largest HIPAA fine in history for a data breach was for the Anthem hack, which was a leak of ~80 million records and Anthem was fined $115 million. That's no small number, but at the end of the day it's still only less than 5% of their yearly net income. And Anthem is a huge outlier: the second largest HIPAA fine in history was only ~$6 million. It's not exactly a huge deterrent for companies that want to ignore security. In terms of the public exposure, you'd probably be surprised at how many healthcare insurers/providers have data breaches but you never hear about them because these companies know how/when to report it so that it ends up nothing more than a footnote on the back page of the local paper.
derefr 9y ago
> But how many startups fail due to lack of a security team? Crypto exchange startups, for a big, glaring example. They’re an exception in a lot of ways, though.

caymanjim 9y ago

In a large company, a company with sufficiently-sensitive data (where loss is a legal matter), or a company with a lot of money to lose (financial processing), having a dedicated security team might make sense and might be worth the money, but in most situations, I think it does more harm than good. Security teams rarely know how applications work, so their approach to security is heavy-handed and provides a false sense of protection. It's more important to instill everyone with security-minded philosophy, so that applications and systems are designed with security in mind from the beginning. Firewalls, packet inspection, virus scanning, and the like would all be completely unnecessary if code was written securely and if human beings behaved properly. Of course these things don't happen, and of course firewalls and scans and the like are common-sense protections, but most data loss is caused by poorly-designed applications which run in very secure environments. Dedicated security teams simply aren't in a position to identify and solve problems like buffer overruns or SQL injection.

pbhjpbhj 9y ago
>Security teams rarely know how applications work, // I'm amazed if anyone working in a computer security role doesn't know about SQL injection attacks and their mitigations. You'll be telling me they don't know about salting passwords next??
- taway1929293 9y ago
  Where I work, yes, the security teams don't know how applications work. we have a dedicated security team - they run nessus scans for compliance and network scans and hand them to managers and executives who hand them to us. they explicitly don't touch the code - a senior guy has declared that he's not responsible on that level, that he's 'no coder' in response to a shell injection vulnerability. so he knows 'about' salting passwords but he probably couldn't verify if they are salted or not. To me it's left the impressions that 1) security is mostly theater and 2) 'security engineer' is a meaningless title - it can mean anything from 'runs scans' to 'network administrator' to 'penetration tester' to 'good engineer'. unfortunately my default attitude towards the title has been "i'm probably dealing with a charlatan"

cookiecaper 9y ago

I'm going to disagree on the basis that segmenting your security personnel creates a lot of difficult social dynamics. However the model is structured, "security" becomes a pain point, and no one wants to see the security guy coming around the corner. The default interpretation (which is basically the only one that counts) is that this guy is coming around, tearing down _your_ work, and making you look bad in front of everyone, and what does he even know about this thing? Some people will chicken out, not press the matter, and then the "security people" are just the fall guys, unable to do anything other than take the blame for the other peoples' screw-ups. In my experience, a lot of internal security people end up stuck in that position whether they're trying to fight the good fight or not. The dynamic is similar to the corrosive POV that sees "dev" and "ops" as orthogonal concerns to segment out, and we all know how well that's gone over. Anyone looking forward to hearing all about "DevSec" in the next 10-15 years, once some startup finds a way to put a cute icon on it and gets a big pile of investor money to burn (cf. Docker)? Rather than create a tense segmentation, it's better to just hire competent developers who know security well from the get-go. Maybe they can rotate weeks doing security reviews or something like that. I don't know, I don't really have a good solution. I just know that making someone the enemy by labeling them "security personnel, here to block your deploys, tell you you're doing your job wrong, and generally just embarrass you in front of your peers and superiors" is not going to help much.

ggg9990 9y ago

Companies won’t take security seriously until 1) customers demand methods of evaluating the security of a company and making purchasing decisions accordingly — “size of security team” doesn’t count, and 2) sufficiently punishing companies that cause user harm through security failures, i.e. forcibly liquidating Equifax and confiscating all senior executives’ assets including their house.