4 ms·

Personally I think it's both. We're seeing companies that normally would have gone public (enterprise software like Carbon Black) at the appropriate time, combi

Personally I think it's both. We're seeing companies that normally would have gone public (enterprise software like Carbon Black) at the appropriate time, combined with some companies where it makes little sense to go public (Spotify, Snapchat) that I think are cashing in before the bottom drops out. Carbon Black has nowhere to go but up, they're destroying the AV industry and every security consultant I know is pushing this style of endpoint protection over traditional AV. And they're in the enterprise market, so they can charge big bucks. Spotify on the other hand is one player in a crowded and competitive market with some huge players who could destroy them in a heartbeat. And even with their exclusives and much bigger subscriber count, they're still struggling to beat much smaller competitors in actual engagement [1] (or at the very least struggling to properly count their streams which seems like a basic requirement). It makes little sense for them to go public when they could just as easily be out of business this time next year. [1] https://www.theverge.com/2018/4/3/17192342/apple-music-the-weeknd-my-dear-melancholy-spotify https://www.theverge.com/2018/4/3/17192342/apple-music-the-w...

TAForObvReasons 9y ago
Spotify was "forced" into IPO in a way: https://www.recode.net/2018/1/3/16847786/spotify-tpg-tencent-debt-dragoneer-ipo-music-streaming https://www.recode.net/2018/1/3/16847786/spotify-tpg-tencent... > In 2016, TPG, Dragoneer and Goldman Sachs lent Spotify $1 billion via convertible debt financing, which was supposed to give the lenders the ability to eventually turn their loans into equity. > The deal let Spotify bide its time before an IPO, but not too much time: The longer Spotify took to go public, the better the terms would get for the lenders. News emerged Wednesday that the company had confidentially filed IPO documents in late December.
ocfx 9y ago
Cylance is doing a lot better.
woolvalley 9y ago
As a carbon black victim who gets angry at CB consuming %50 of my CPU in the kernel as I do builds that touch many small files, it just feels like a combination of corporate spyware/rootkits, traditional antivirus and uploading that info to a backend. Am I wrong? Why hasn't traditional AV created a similar product then?
- dcuthbertson 9y ago
  I feel your pain. I used to work for Bit9. Some customers found their Java builds slowed down a lot due to all the temporary files created and Bit9 trying to hash them. From what I understand, AV just tries to match hash signatures. CB is doing more analysis. It's a tougher not to crack.
- freehunter 9y ago
  Carbon Black is far from the only player in the space. Tanium, Crowdstrike, Trusteer, Cylance, Cisco AMP, etc. The way these "next-gen" endpoint systems work is by doing a deep analysis of every file, and like you said, uploading the hash to a central server for faster processing later. Your use case is atypical for CB customers but I fully believe you're having these issues. There's a drawback to every kind of endpoint protection. It does seem that the more general population is worse off with traditional malware protection than CB, but your use case seems non-traditional. I should note that I am not affiliated with any endpoint product and AFAIK the absolutely massive company I work for doesn't even have an endpoint product that competes in the next-gen space. I'm just a security consultant who sees a lot of Fortune 500 companies and notices the trends they set/follow. It's trending away from Symantec and towards Carbon Black/Tanium/Cylance/etc.
  - sqldba 9y ago
    Do you feel it’s technically superior or just people following the fancy new tech dragon (or something else like because it also lets you spy on employees, if it does, I don’t know)? (Not that it’s really fancy new tech - checksum AV have been around even since DOS. I’d have thought the best thing would be a combination of the two).
    - freehunter 9y ago
      I do think it's technically superior when used right. Namely, application whitelisting is technically superior. Most employees only have a small number of applications they need to run, and making sure everything else fails to start is the right choice. Obviously it's not perfect for everyone and technical staff will often need to run esoteric and constantly-changing applications, so whitelisting isn't always possible. In that case, using a checksum and having the central server is a better way of handling it. Better yet is something like FireEye which can intercept your file downloads and scan them before it hits your machine. I can't speak for which next-gen endpoint solution works best since that's not my area of expertise, but I can say it's better than traditional AV (which is basically useless). In that case, blacklisting is the better choice, for software no one should have installed. "Spying on employees" is an interesting take on what I consider to be basic security. I'm heavily involved in technology that, if the end user saw what we could see, they'd be horrified. Basically, if you're in the US and using your employer's laptop on your employer's network, you have zero privacy and everything you do and every site you visit is being logged into a central log repository and can be made available to the security and audit teams at a moment's notice. Most of the time no one is watching it, no one except an AI looking for anomalies and reporting on outliers, but it's possible. If you're doing DNS lookups to your company's DNS server, they know every site you've visited. If you're using telnet or ftp or POP3, they know your passwords too, because they're likely sniffing internal network traffic as well and storing packet captures. And they may even be breaking SSL at the proxy or gateway level, so that doesn't help you. Basically, if you're worried that Carbon Black sending a list of your installed applications is your employer "spying" on you, they're already collecting far more data than you think. Installed applications is the least of your concern. But again... that's not your laptop and it's not your network. It's all owned by your company, and governed by their acceptable use policy in the employee handbook.

TAForObvReasons 9y ago

Spotify was "forced" into IPO in a way: https://www.recode.net/2018/1/3/16847786/spotify-tpg-tencent-debt-dragoneer-ipo-music-streaming https://www.recode.net/2018/1/3/16847786/spotify-tpg-tencent... > In 2016, TPG, Dragoneer and Goldman Sachs lent Spotify $1 billion via convertible debt financing, which was supposed to give the lenders the ability to eventually turn their loans into equity. > The deal let Spotify bide its time before an IPO, but not too much time: The longer Spotify took to go public, the better the terms would get for the lenders. News emerged Wednesday that the company had confidentially filed IPO documents in late December.

ocfx 9y ago

Cylance is doing a lot better.

woolvalley 9y ago

As a carbon black victim who gets angry at CB consuming %50 of my CPU in the kernel as I do builds that touch many small files, it just feels like a combination of corporate spyware/rootkits, traditional antivirus and uploading that info to a backend. Am I wrong? Why hasn't traditional AV created a similar product then?

dcuthbertson 9y ago
I feel your pain. I used to work for Bit9. Some customers found their Java builds slowed down a lot due to all the temporary files created and Bit9 trying to hash them. From what I understand, AV just tries to match hash signatures. CB is doing more analysis. It's a tougher not to crack.
freehunter 9y ago
Carbon Black is far from the only player in the space. Tanium, Crowdstrike, Trusteer, Cylance, Cisco AMP, etc. The way these "next-gen" endpoint systems work is by doing a deep analysis of every file, and like you said, uploading the hash to a central server for faster processing later. Your use case is atypical for CB customers but I fully believe you're having these issues. There's a drawback to every kind of endpoint protection. It does seem that the more general population is worse off with traditional malware protection than CB, but your use case seems non-traditional. I should note that I am not affiliated with any endpoint product and AFAIK the absolutely massive company I work for doesn't even have an endpoint product that competes in the next-gen space. I'm just a security consultant who sees a lot of Fortune 500 companies and notices the trends they set/follow. It's trending away from Symantec and towards Carbon Black/Tanium/Cylance/etc.
- sqldba 9y ago
  Do you feel it’s technically superior or just people following the fancy new tech dragon (or something else like because it also lets you spy on employees, if it does, I don’t know)? (Not that it’s really fancy new tech - checksum AV have been around even since DOS. I’d have thought the best thing would be a combination of the two).
  - freehunter 9y ago
    I do think it's technically superior when used right. Namely, application whitelisting is technically superior. Most employees only have a small number of applications they need to run, and making sure everything else fails to start is the right choice. Obviously it's not perfect for everyone and technical staff will often need to run esoteric and constantly-changing applications, so whitelisting isn't always possible. In that case, using a checksum and having the central server is a better way of handling it. Better yet is something like FireEye which can intercept your file downloads and scan them before it hits your machine. I can't speak for which next-gen endpoint solution works best since that's not my area of expertise, but I can say it's better than traditional AV (which is basically useless). In that case, blacklisting is the better choice, for software no one should have installed. "Spying on employees" is an interesting take on what I consider to be basic security. I'm heavily involved in technology that, if the end user saw what we could see, they'd be horrified. Basically, if you're in the US and using your employer's laptop on your employer's network, you have zero privacy and everything you do and every site you visit is being logged into a central log repository and can be made available to the security and audit teams at a moment's notice. Most of the time no one is watching it, no one except an AI looking for anomalies and reporting on outliers, but it's possible. If you're doing DNS lookups to your company's DNS server, they know every site you've visited. If you're using telnet or ftp or POP3, they know your passwords too, because they're likely sniffing internal network traffic as well and storing packet captures. And they may even be breaking SSL at the proxy or gateway level, so that doesn't help you. Basically, if you're worried that Carbon Black sending a list of your installed applications is your employer "spying" on you, they're already collecting far more data than you think. Installed applications is the least of your concern. But again... that's not your laptop and it's not your network. It's all owned by your company, and governed by their acceptable use policy in the employee handbook.