3 ms·

I work for a network hardware and security vendor and its utterly disheartening how many customers come to us and don't actually care about the impact of any of

by kayfox 8y ago

I work for a network hardware and security vendor and its utterly disheartening how many customers come to us and don't actually care about the impact of any of the vulnerabilities they ask us about, they just care about the CVSS score, its PCI impact and their often bizarre policy about them. Theres often less concern about actually doing something about security risks and more concern about meeting their compliance goals. Now, this may be biased by who actually reaches out, but it is scary that big names have underlings who dont know the first thing about some of the security issues their "investigating". In another discussion the other day, I had heard programming these days compared to slowly transitioning out of the hunter-gatherer phase and into more structured society. From what I have seen this largely rings true, we are still relying on software that is largely not engineered, but written with loose engineering. The security industry seems to largely be like this, but more of a wild west (as depicted in Westerns) feel to it. Some companies and organizations have structured strategies for security, but even in large organizations like Equifax theres still a kinda "go shoot the bad guys and tie up the gate so the cattle dont get out" aspect to it, very ad hoc. I am hoping the industry moves more towards engineering things, standardizing interactions, characterizing software modules, etc so that the security industry can spend less time on wild goose chases when trying to figure out how something is supposed to work and how this latest vulnerability applies to that.

tracker1 8y ago
It comes down to risk, cost, reward. If it costs you one developer 3 months to build a utility used by 5 people in your company, but would cost 3 years for a team of 5 to write an "engineered" version with security focus, it may never happen. It depends on need and risk.
- pojzon 8y ago
  I often compare that to the professional approach of picking correct tool to solve a problem. If client doesnt need extensive security i would strongly advice him to make compromises to push his product out faster. Professionals should put client needs at first place and help meet them without making the client run out of money running after some Utopian image he does not even need. There is a saying which also expresses the same intent: "life is a series of compromises".
- flukus 8y ago
  > It comes down to risk, cost, reward. In theory I agree that there are trade offs like this, but in practice I rarely see them being applied properly. A small startup up using electron to build a cross platform app for instance, I can see how that's a good trade off, but then you see multi-billion dollar companies with hundreds of devs and millions of users building electron apps when they can easily dedicate the resource for native ones. Security tends to be similar, giant (non-tech) companies with lots of important data are the ones that optimize for cost the most and don't care about the risk.
  - tracker1 8y ago
    I'm not sure that I entirely agree... VS Code is really well supported across platforms that otherwise may have been left behind. Contrast to say MS Teams, which doesn't have as broad support outside Windows/Mac, that irks me more. I'm a pretty big fan of Electron + Cordova to reach a broader base of users. I don't think it's a net bad as a user who prefers the same tools on windows, linux and mac as much as possible. There are a lot of things you get in the box with a browser based platform beyond the cross browser support. I mean even reflows and alignments working right are far more consistent, more easily. CSS/Styling is the same as the browser which is very flexible/capable. Some may dislike JS, but it gets the job done. But on the flip side, I've seen people build an entire application (executable) or service from what could be a simple script in any given scripting language.
tannhaeuser 8y ago
> I am hoping the industry moves more towards engineering things, standardizing interactions [...] Good luck with that. From my PoV, the "industry" has moved away from standardization ever since around 2008 when the "consumerization of IT" became a thing. Almost no meaningful standardization has been carried out in this decade. Previous efforts are being derided (XML bashing etc.) by people who haven't experienced 1990s lock-in. The web is driven ad absurdum with folks standing by and cheering. Enterprises are catering to the uneducated with "REST microservice" spaghetti, and younger devs mostly get their information from random (or even targetted) product blogs on the 'web.
Frost1x 8y ago
If you've ever worked in the safety industry, it's not all that different. When it comes to safety features, compliance, and training, most companies take the same approach at meeting minimum legal requirements and passing liability wherever they can for cost savings. If they can cut corners and not hurt profit margins, they will gamble. If businesses tend to ignore safety and gamble with respect to human life (in scenarios where it results in net cost savings), I have no remote disillusionment that they'll care about data security in cases human life isn't at risk (again, unless it's shown to reduce overall costs and convince management of that).
jacobsenscott 8y ago
For companies that need to meet regulations compliance goals do indeed trump fixing real security issues. Companies can go out of business or lose big clients if they don't get PCI certification or whatever. The executive in charge of meeting compliance goals has a very clear pass/fail - the company is certified or it isn't. The policies are bizarre because they are driven by auditing firms who are incentivized to make compliance a lot of work, but attainable. A lot of work so they can bill a lot of hours. Attainable because nobody will hire them if they don't provide certification in the end. Effectiveness of the policies is not a factor. It is an entire universe of perverse incentives. The engineers toiling away to meet the goals know it, but there's nothing they can do.

by kayfox 8y ago

tracker1 8y ago

It comes down to risk, cost, reward. If it costs you one developer 3 months to build a utility used by 5 people in your company, but would cost 3 years for a team of 5 to write an "engineered" version with security focus, it may never happen. It depends on need and risk.

pojzon 8y ago
I often compare that to the professional approach of picking correct tool to solve a problem. If client doesnt need extensive security i would strongly advice him to make compromises to push his product out faster. Professionals should put client needs at first place and help meet them without making the client run out of money running after some Utopian image he does not even need. There is a saying which also expresses the same intent: "life is a series of compromises".
flukus 8y ago
> It comes down to risk, cost, reward. In theory I agree that there are trade offs like this, but in practice I rarely see them being applied properly. A small startup up using electron to build a cross platform app for instance, I can see how that's a good trade off, but then you see multi-billion dollar companies with hundreds of devs and millions of users building electron apps when they can easily dedicate the resource for native ones. Security tends to be similar, giant (non-tech) companies with lots of important data are the ones that optimize for cost the most and don't care about the risk.
- tracker1 8y ago
  I'm not sure that I entirely agree... VS Code is really well supported across platforms that otherwise may have been left behind. Contrast to say MS Teams, which doesn't have as broad support outside Windows/Mac, that irks me more. I'm a pretty big fan of Electron + Cordova to reach a broader base of users. I don't think it's a net bad as a user who prefers the same tools on windows, linux and mac as much as possible. There are a lot of things you get in the box with a browser based platform beyond the cross browser support. I mean even reflows and alignments working right are far more consistent, more easily. CSS/Styling is the same as the browser which is very flexible/capable. Some may dislike JS, but it gets the job done. But on the flip side, I've seen people build an entire application (executable) or service from what could be a simple script in any given scripting language.

tannhaeuser 8y ago

> I am hoping the industry moves more towards engineering things, standardizing interactions [...] Good luck with that. From my PoV, the "industry" has moved away from standardization ever since around 2008 when the "consumerization of IT" became a thing. Almost no meaningful standardization has been carried out in this decade. Previous efforts are being derided (XML bashing etc.) by people who haven't experienced 1990s lock-in. The web is driven ad absurdum with folks standing by and cheering. Enterprises are catering to the uneducated with "REST microservice" spaghetti, and younger devs mostly get their information from random (or even targetted) product blogs on the 'web.

Frost1x 8y ago

If you've ever worked in the safety industry, it's not all that different. When it comes to safety features, compliance, and training, most companies take the same approach at meeting minimum legal requirements and passing liability wherever they can for cost savings. If they can cut corners and not hurt profit margins, they will gamble. If businesses tend to ignore safety and gamble with respect to human life (in scenarios where it results in net cost savings), I have no remote disillusionment that they'll care about data security in cases human life isn't at risk (again, unless it's shown to reduce overall costs and convince management of that).

jacobsenscott 8y ago

For companies that need to meet regulations compliance goals do indeed trump fixing real security issues. Companies can go out of business or lose big clients if they don't get PCI certification or whatever. The executive in charge of meeting compliance goals has a very clear pass/fail - the company is certified or it isn't. The policies are bizarre because they are driven by auditing firms who are incentivized to make compliance a lot of work, but attainable. A lot of work so they can bill a lot of hours. Attainable because nobody will hire them if they don't provide certification in the end. Effectiveness of the policies is not a factor. It is an entire universe of perverse incentives. The engineers toiling away to meet the goals know it, but there's nothing they can do.