4 ms·

The issue is less about people unwilling to take those wages, and more about a lack of people whose breath can even fog a security mirror so to speak. I work in

The issue is less about people unwilling to take those wages, and more about a lack of people whose breath can even fog a security mirror so to speak. I work in security and have been involved with hiring at several “brand name” companies including FAANGs in hot tech markets, and it’s always been a talent pipeline issue more than anything. Given how difficult it is for the biggest players to keep security staffed up, and they still get hacked routinely, I can’t imagine how low quality the applicant pool is at Colonial, and doubt it would have made a difference. Almost every company of moderate size perpetually has openings for security roles. The other problem is that the industry has an oversupply of by-the-book certified security people who can configure firewalls and run scanners, but who have never dealt with live hackers or hacked anything themselves. But hackers are clever and artistic, and defending against them isn’t like following a recipe for baking a cake. And as an employer looking to introduce security, there is no way to really evaluate a good security leader vs a charlatan, and then it’s either bad hires all the way down, or talented people on the bottom who lack leadership and are ineffective in the bureaucracy.

grumple 5y ago
The problem I see is that there are tradeoffs between security and usability, and again between developing security vs developing features. Security doesn't make money next quarter, while features and ease of use do. Any software engineer can do security if they spend time learning and working on it. But executives don't seem to care about it.
- lawnchair_larry 5y ago
  Weird to see this downvoted, it’s completely accurate and pretty basic economics. Security is a cost center, product development is a revenue multiplier. Investing in the latter as much as you can get away with is the most rational way to allocate resources.
socialist_coder 5y ago
Is being a "good" security person really more involved than: * making sure you have all your ports locked down * limit connectivity between all instances to only the bare minimum * any public access is via protocols such as ssh which have zero-to-none vulnerabilities * any 3rd party software you dont know is secure should never be public * routinely run employee training on how not to let themselves get hacked via social engineering I'm sure I'm missing other stuff, but I feel like if you follow these "best practices", you have just made yourself a very hard target and hackers will probably skip over you unless they have some weird reason to target your org specifically. So for 95% of companies out there, this level of security should be sufficient. I'm legitimately asking - is this sufficient? Or are hackers so creative that even following these basic rules will still not make you a hard target? This stuff seems fairly easy to do but I agree you need training or an info-sec person making sure your dev teams are doing it all. You can't have any slip ups. Your devs / managers have to take it seriously.
- tgsovlerkhgsel 5y ago
  Yes, it is a lot more involved. In particular, "routinely run training" might reduce the probability of a breach due to social engineering, but it probably won't. You also didn't really cover client machine security, which is how compromises often happen. Your awesome security isn't worth much if the admin's machine is compromised. Your employees need to use computers to do their job. As part of that, they will need to browse the web, which they will do with one of the major browsers. This browser has unknown 0-day vulnerabilities. Whatever security measures you implement must not disrupt business. They may also need to plug in USB drives. These can come with malware. Whatever security measures you implement must not disrupt business. They may also need to open documents, possibly with macros. Whatever security measures you implement must not disrupt business. Your "basic rules" will at best prevent the - still extremely common - social engineering based attacks, but they still won't reliably keep an attacker out of your network. The attacker will compromise a random person, find some company-wide writeable shared network drive (that you didn't even know about) where a team shares their executables, replace one of those, compromise more machines, escalate to domain admin credentials through one of the many ways that exist, then use your own fleet management system to push their backdoor to your entire fleet. For good security, you need for example: - an overview of what assets (computers etc.) you actually have - a decent way to manage these assets - monitoring so you can hopefully detect when (not if) a compromise happens - many layers of defense in depth that slow down attackers and limit what they can do once they've compromised one part of your company - technical barriers to prevent social engineering attacks (binary whitelisting, strong multi-factor authentication) - protection against insider risks - physical security and that's just a few things that popped into my head, the actual list would probably not fit whatever post length limits HN has. And of course all of this needs to be implemented with the limited budget the company is willing to give you, without disrupting the business, etc.
  - socialist_coder 5y ago
    Thanks for the great response! Very informative. I assumed I was way simplifying the problem. It seems like what works for my small remote only startup is not even close to what you need for a large in-person org running who-knows-what software.
notyourday 5y ago
> The issue is less about people unwilling to take those wages, and more about a lack of people whose breath can even fog a security mirror so to speak. I work in security and have been involved with hiring at several “brand name” companies including FAANGs in hot tech markets, and it’s always been a talent pipeline issue more than anything. Oh come on. It is just an excuse. Look up what FAANG pays for those jobs ( total compensation ). Pay 2x. Get people from FAANG to work for you.
- erosenbe0 5y ago
  Game theory says nah, just do enough so the other guy gets hit first. I mean I could spend the kids' college fund turning the house into an impenetrable fort with bulletproof glass, booby traps, 2 ton doors and concrete walls; or I can spend a few thousand and get a really grumpy window cat so a burglar moves on to an easier target.
- lawnchair_larry 5y ago
  That’s a pretty silly way to look at it. There are a lot of reasons, but the most obvious is that you just moved people around, you didn’t get any new ones. It’s zero sum in the short term, because there are many many years of latency to correct the talent pipeline on something like security.

grumple 5y ago

The problem I see is that there are tradeoffs between security and usability, and again between developing security vs developing features. Security doesn't make money next quarter, while features and ease of use do. Any software engineer can do security if they spend time learning and working on it. But executives don't seem to care about it.

lawnchair_larry 5y ago
Weird to see this downvoted, it’s completely accurate and pretty basic economics. Security is a cost center, product development is a revenue multiplier. Investing in the latter as much as you can get away with is the most rational way to allocate resources.

socialist_coder 5y ago

Is being a "good" security person really more involved than: * making sure you have all your ports locked down * limit connectivity between all instances to only the bare minimum * any public access is via protocols such as ssh which have zero-to-none vulnerabilities * any 3rd party software you dont know is secure should never be public * routinely run employee training on how not to let themselves get hacked via social engineering I'm sure I'm missing other stuff, but I feel like if you follow these "best practices", you have just made yourself a very hard target and hackers will probably skip over you unless they have some weird reason to target your org specifically. So for 95% of companies out there, this level of security should be sufficient. I'm legitimately asking - is this sufficient? Or are hackers so creative that even following these basic rules will still not make you a hard target? This stuff seems fairly easy to do but I agree you need training or an info-sec person making sure your dev teams are doing it all. You can't have any slip ups. Your devs / managers have to take it seriously.

tgsovlerkhgsel 5y ago
Yes, it is a lot more involved. In particular, "routinely run training" might reduce the probability of a breach due to social engineering, but it probably won't. You also didn't really cover client machine security, which is how compromises often happen. Your awesome security isn't worth much if the admin's machine is compromised. Your employees need to use computers to do their job. As part of that, they will need to browse the web, which they will do with one of the major browsers. This browser has unknown 0-day vulnerabilities. Whatever security measures you implement must not disrupt business. They may also need to plug in USB drives. These can come with malware. Whatever security measures you implement must not disrupt business. They may also need to open documents, possibly with macros. Whatever security measures you implement must not disrupt business. Your "basic rules" will at best prevent the - still extremely common - social engineering based attacks, but they still won't reliably keep an attacker out of your network. The attacker will compromise a random person, find some company-wide writeable shared network drive (that you didn't even know about) where a team shares their executables, replace one of those, compromise more machines, escalate to domain admin credentials through one of the many ways that exist, then use your own fleet management system to push their backdoor to your entire fleet. For good security, you need for example: - an overview of what assets (computers etc.) you actually have - a decent way to manage these assets - monitoring so you can hopefully detect when (not if) a compromise happens - many layers of defense in depth that slow down attackers and limit what they can do once they've compromised one part of your company - technical barriers to prevent social engineering attacks (binary whitelisting, strong multi-factor authentication) - protection against insider risks - physical security and that's just a few things that popped into my head, the actual list would probably not fit whatever post length limits HN has. And of course all of this needs to be implemented with the limited budget the company is willing to give you, without disrupting the business, etc.
- socialist_coder 5y ago
  Thanks for the great response! Very informative. I assumed I was way simplifying the problem. It seems like what works for my small remote only startup is not even close to what you need for a large in-person org running who-knows-what software.

notyourday 5y ago

> The issue is less about people unwilling to take those wages, and more about a lack of people whose breath can even fog a security mirror so to speak. I work in security and have been involved with hiring at several “brand name” companies including FAANGs in hot tech markets, and it’s always been a talent pipeline issue more than anything. Oh come on. It is just an excuse. Look up what FAANG pays for those jobs ( total compensation ). Pay 2x. Get people from FAANG to work for you.

erosenbe0 5y ago
Game theory says nah, just do enough so the other guy gets hit first. I mean I could spend the kids' college fund turning the house into an impenetrable fort with bulletproof glass, booby traps, 2 ton doors and concrete walls; or I can spend a few thousand and get a really grumpy window cat so a burglar moves on to an easier target.
lawnchair_larry 5y ago
That’s a pretty silly way to look at it. There are a lot of reasons, but the most obvious is that you just moved people around, you didn’t get any new ones. It’s zero sum in the short term, because there are many many years of latency to correct the talent pipeline on something like security.