5 ms·

Why on earth did this make it to the front page. What a silly site. "Haha some company got breached and they made decisions I consider a mistake. Haha they hir

Why on earth did this make it to the front page. What a silly site. "Haha some company got breached and they made decisions I consider a mistake. Haha they hired a CISSP,how lame." How marvelously retarded. How about demonstrating some understanding of the complexities and difficulties involved in securing any large corporation? How about suggesting some solutions? I can tell you one problem clearly: Management and C-suite do not get clear,useful and actionable security risk analysis with what practical solutions exist. I can also tell you idiots who communicate this way are worse than actual hackers trying to breach companies. Of course there is a bigger problem of legal accountability which is a law making and voter education problem. Oh and regarding CISSPs, do you have any idea how hard it is to hire people that know their tradecraft? Even for a decent salary and benefits and schedule? Very difficult if you're not a fortune 100! Would OSCP impress you? Wth is a guy who only knows pentesting worth unless you're hiring for a pentester? Heck, a CISSP that can't even code but undetstands security threats/risk and can communicate is worth 20 OSCPs for most orgs!

djsumdog 7y ago
Jokes and silly comments are often downvoated, flagged and even against some of the rules here. Sure,HN is not Reddit ... so when something like this makes the top, it actually does feel kinda nice. It may be silly, but it gave me a chuckle in an otherwise sad and terrible world. That is worth something today, I think.
- badrabbit 7y ago
  Silly as in dumb. Not silly as in funny. I got that it wad a joke but I hate the false premise and narrative it pushes. People actually believe some of that crap
throwaheyy 7y ago
It's a joke site, it generates random excuses for data breaches.
- badrabbit 7y ago
  Random excuses presumed to be funny because they're wrong. I disagree strongly with most of them and I hate the oversimplification it promotes. I hate that it promotes this stupid attitude that companies are stupid and unethical because they don't care about infosec as much as they should. People who think this is funny probably also blame users for being too stupid/ignorant for most security incidents. Haha,users management even other IT workers are dumb. Everyone is ignorant except the elite infosec hackers...you can see why it's difficult to listen to anything someone with this attitude has to say. If no one listens to you,you can't educate them. If you're not willing to listen and understand others' perspective they will ignore yours,even if your peers think you're the best hacker ever!
- sundvor 7y ago
  It's more funny because it's so often true. Just like how many people get a dashcam after a crash, organisations tend to get serious after the breach.
  - badrabbit 7y ago
    That why I hate it and made my cmment. I strongly disagree with the narrative they push under the guise of a joke. Very arrogant and shallow
  - eitland 7y ago
    > Just like how many people get a dashcam after a crash, organisations tend to get serious after the breach. To the degree that they get serious that is. As far as I can see a big part of the joke here is that even that is questionable.
    - badrabbit 7y ago
      Serious as in minimize loss not serious in they now care about security.
    - sundvor 7y ago
      True!
numlock86 7y ago
r/woooosh Yes, someone had to say it.
- badrabbit 7y ago
  Only applies if i missed the joke. Simply hate it
thephyber 7y ago
Your whole post both misses the point of this site and misses the blame for the points you raise. > How about suggesting some solutions? Why not contact the makers of the site and ask them? It's pretty clear they made this website for a little bit of marketing for a security training vendor: > Reflare is an IT Security training company helping executives and IT professionals create more secure organizations. My personal $0.02 is to look at what Salesforce did. They hired pen testers to hack their board members and to reveal to each of them their most personal / valuable / embarrassing data. That breaks the ice and loosens the purse strings. Spend on a security team like a financial institution would. Then the entire company institutes "distributed security": gamification mechanics applied to all aspects of security. Incentivize _every_ _single_ _employee_ and contractor to be involved in security. Give out quarterly tropical vacataions to _any_ employee which improves company security the most. Train them -- every single hire. Compartmentalize + least privilege. > Haha they hired a CISSP,how lame The site randomly picks from an array of mitigations: * made everyone promise to be super super careful * gotten ISO certified * gotten PCI certified - worked with industry leading specialists - upskilled our cafeteria staff - hired external consultants - worked with law enforcement - bought an IDS - twiddled with our firewall - been pretty good about security - hired some people with 'CISSP' after their names - watched a YouTube video on cyber security - told them to not do it again - said that we are very sorry - copy-pasted a security policy we found on Google - hired a Russian dude - watched the movie Hackers 8 times back to back - sent one of our guys to Defcon - put a rotating lock GIF on our website Hiring a CISSP doesn't seem as ridiculous as the other options, but all things considered, I would rather a company hire CISSPs before they get breached. If they do it only after they get breached, I'd rather the company go bankrupt as a lesson the competition. I'm 100% in support of this website poking at Equifax because the post-breach repercussions have been far too lenient on the company and I hope every company fears bing "the next Equifax". > Management and C-suite do not get clear,useful and actionable security risk analysis Management and the C-Suite exist to hire the team that can give them the information + performance they want. It sounds like the C-Suite needs to learn what they don't know and then hire a CIO+CISO. In the end, there is a risk trade-off. Far too many companies just "accept the risk" or simply buy cyber insurance (rather than investing in risk mitigations) then get breached. Far too few companies get liquidated when they get breached, sending a bad signal to their competition. Most companies don't want to lock down their product to absolute minimum risk (because that is fantastically expensive) and just aim to spend "the industry average" on security.

djsumdog 7y ago

Jokes and silly comments are often downvoated, flagged and even against some of the rules here. Sure,HN is not Reddit ... so when something like this makes the top, it actually does feel kinda nice. It may be silly, but it gave me a chuckle in an otherwise sad and terrible world. That is worth something today, I think.

badrabbit 7y ago
Silly as in dumb. Not silly as in funny. I got that it wad a joke but I hate the false premise and narrative it pushes. People actually believe some of that crap

throwaheyy 7y ago

It's a joke site, it generates random excuses for data breaches.

badrabbit 7y ago
Random excuses presumed to be funny because they're wrong. I disagree strongly with most of them and I hate the oversimplification it promotes. I hate that it promotes this stupid attitude that companies are stupid and unethical because they don't care about infosec as much as they should. People who think this is funny probably also blame users for being too stupid/ignorant for most security incidents. Haha,users management even other IT workers are dumb. Everyone is ignorant except the elite infosec hackers...you can see why it's difficult to listen to anything someone with this attitude has to say. If no one listens to you,you can't educate them. If you're not willing to listen and understand others' perspective they will ignore yours,even if your peers think you're the best hacker ever!
sundvor 7y ago
It's more funny because it's so often true. Just like how many people get a dashcam after a crash, organisations tend to get serious after the breach.
- badrabbit 7y ago
  That why I hate it and made my cmment. I strongly disagree with the narrative they push under the guise of a joke. Very arrogant and shallow
- eitland 7y ago
  > Just like how many people get a dashcam after a crash, organisations tend to get serious after the breach. To the degree that they get serious that is. As far as I can see a big part of the joke here is that even that is questionable.
  - badrabbit 7y ago
    Serious as in minimize loss not serious in they now care about security.
  - sundvor 7y ago
    True!

numlock86 7y ago

r/woooosh Yes, someone had to say it.

badrabbit 7y ago
Only applies if i missed the joke. Simply hate it

thephyber 7y ago

Your whole post both misses the point of this site and misses the blame for the points you raise. > How about suggesting some solutions? Why not contact the makers of the site and ask them? It's pretty clear they made this website for a little bit of marketing for a security training vendor: > Reflare is an IT Security training company helping executives and IT professionals create more secure organizations. My personal $0.02 is to look at what Salesforce did. They hired pen testers to hack their board members and to reveal to each of them their most personal / valuable / embarrassing data. That breaks the ice and loosens the purse strings. Spend on a security team like a financial institution would. Then the entire company institutes "distributed security": gamification mechanics applied to all aspects of security. Incentivize _every_ _single_ _employee_ and contractor to be involved in security. Give out quarterly tropical vacataions to _any_ employee which improves company security the most. Train them -- every single hire. Compartmentalize + least privilege. > Haha they hired a CISSP,how lame The site randomly picks from an array of mitigations: * made everyone promise to be super super careful * gotten ISO certified * gotten PCI certified - worked with industry leading specialists - upskilled our cafeteria staff - hired external consultants - worked with law enforcement - bought an IDS - twiddled with our firewall - been pretty good about security - hired some people with 'CISSP' after their names - watched a YouTube video on cyber security - told them to not do it again - said that we are very sorry - copy-pasted a security policy we found on Google - hired a Russian dude - watched the movie Hackers 8 times back to back - sent one of our guys to Defcon - put a rotating lock GIF on our website Hiring a CISSP doesn't seem as ridiculous as the other options, but all things considered, I would rather a company hire CISSPs before they get breached. If they do it only after they get breached, I'd rather the company go bankrupt as a lesson the competition. I'm 100% in support of this website poking at Equifax because the post-breach repercussions have been far too lenient on the company and I hope every company fears bing "the next Equifax". > Management and C-suite do not get clear,useful and actionable security risk analysis Management and the C-Suite exist to hire the team that can give them the information + performance they want. It sounds like the C-Suite needs to learn what they don't know and then hire a CIO+CISO. In the end, there is a risk trade-off. Far too many companies just "accept the risk" or simply buy cyber insurance (rather than investing in risk mitigations) then get breached. Far too few companies get liquidated when they get breached, sending a bad signal to their competition. Most companies don't want to lock down their product to absolute minimum risk (because that is fantastically expensive) and just aim to spend "the industry average" on security.