5 ms·

A lot of these companies are actually huge enterprises with dozens if not hundred(s) of cybersecurity consultants and engineers. All of them are CISSPs and GICS

A lot of these companies are actually huge enterprises with dozens if not hundred(s) of cybersecurity consultants and engineers. All of them are CISSPs and GICSPs(I do put my CISSP in the signature when working in those places too though). I go through security reviews all the time with them, they have so many security processes that you get dizzy and on paper everything looks fine. They create security zones with massive risk reviews, but for some reason those security zones then share subnets with the entire LAN. They also have a default configuration which makes everything access the standard intranet directory once its deemed secure. Enterprise security tools like Cyberark are deemed more secure than say yubikey HSMs, which may result in root ssh being enabled in a lot of settings. They have system configurations that are done with massive Excel sheets. Their cloud VPCs basically only have one risk profile and once its deemed secure it gets access to things in the intranet. They also vehemently refuse to do threat modelling when designing anything. These people can tell you so much about the theory of security by heart that it will make you dizzy but then won't actually understand the underlying problems. And the offenders are always the same, advised by Accenture, Infosys etc.

tokamak-teapot 5y ago
Can you explain more about the ‘root ash’ issue please?
- rjzzleep 5y ago
  By using some of these tools they are under the false assumption that things that are otherwise considered security threats are somehow okay because for example the tool rotates passwords for you. It gives a false sense of security and allows you to do things that would otherwise be considered security threats. It's as if someone sells you a laser that shoots intruders and tells you, you can leave the front door open from now on, but that laser only works 1 in 3 times.
  - tokamak-teapot 5y ago
    I see so if people have cyberark they might feel like it’s safe to enable root logins over ssh? That does sound like the sort of thing that would happen.
Godel_unicode 5y ago
ISC² has done so much damage to the industry via enabling the fallacy of appeal to false authority it is mind-blowing. The cissp is such a terrible proof of whether someone knows anything, everyone knows it, but for some reason people keep falling for it.
- mlac 5y ago
  I view it as a shared level of baseline knowledge that helps with conversation. If I see someone has it, it at least tells me they understand the words I’m using and have a basic knowledge of the concepts we are discussing (or should, at least). It also tells me they are good at taking tests. It doesn’t tell me whether they understand how it all works together, or if they understand the organization’s environment, or if they are a good worker. I don’t hold it against people who fail (I’ve seen good people fail the test) or who don’t have it - I just have to ask a few more probing questions to ensure they know the tech I’m discussing. But I don’t outright ask if someone is a CISSP, so typically I ask the clarifying questions anyway so our understanding of the problem is accurate and aligned. And cert or not, I’m still more interested in whether you know what you’re doing than what you put on your resume.
  - Godel_unicode 5y ago
    I wish that were true (genuinely, a shared vocab would be super useful). I've heard so many nonsensical things from CISSPs, I should really start a parody Twitter account. Did you know, for instance, that SSL is an important control for preventing SQL injection? How about that salting is not effective against rainbow tables because of the birthday paradox (yes that's actually what they said). It's just a cram-and-forget vocab test, it doesn't mean anything other than that they could afford the training and the test.
  - srtjstjsj 5y ago
    Sounds like it's a test in Security Fluency, not Solution Providing.
formerly_proven 5y ago
"Centralized hosting and management (SaaS, PaaS model) has the advantage of security at scale." it follows that "Centralized hosting and management (SaaS, PaaS model) has the advantage of insecurity at scale."
arp242 5y ago
I have never understood this; the whole Enterprise™ security business talks about all these things where half the time I literally don't even know what they're on about. They all seem to take it very serious; great! And at the same time they miss basic stuff like, I don't know, subscribing to Apache struct release mailing list. Or not keeping employee credentials around on public servers used to file credit disputes. Or in the case of Solarwinds not using "solarwinds123" as a password (probably not used in the hack, but still). None of this is rocket science and these people probably aren't stupid, so somehow, somewhere, something is going horribly systemically wrong (incentives? Training? Organisation? I don't know).
- smolder 5y ago
  Seems like kind of a corporate/organizational culture thing. Imperfectly distributed knowledge, hierarchical decision-making in groups with misaligned incentives, the limitations of communication and the capacities of individuals... These and more make it hard to operate a large enterprise intelligently and cohesively, and oversights will happen. Corporations can certainly seem to act dumb or just learn slowly as a whole, regardless of who they're made up of. If you go bigger and look at nation-scale, the same problems are present on a greater level.
  - srtjstjsj 5y ago
    Humans can't get this stuff right every time either. It's not like Colin Percival or Theo de Raadt , perfect as they are, could just audit and secure all of the Fortune 500.
cheese_van 5y ago
>These people can tell you so much about the theory of security by heart that it will make you dizzy but then won't actually understand the underlying problems. I've thought greatest failure of many professionals in this field is in the "protect the network" perspective rather than "protect the data". While many of them fess up to "we can make it difficult but not impossible" to breach the network, that is not evinced by the protections instituted. If companies actually understood that they WILL be hacked, the focus would turn to protecting the data. Actual resting data protection would allow a "I don't care if I'm hacked," posture. Either behind encryption, VM's, segregation, or architectures, preferably all, if data is actually protected, then a hack can be weathered. It's still a pain if the computer-touchers have to rebuild and reload, but that's what you pay them for. If the data is protected, a hack is just a painful exercise rather than a newsworthy event. I do understand that segregating (through protection and architecture) data is difficult, but I do not understand why it is not the focus.
- rjzzleep 5y ago
  I always thought that when thinking security a compromised system HAS to be rebuilt. I have never seen that happen in an enterprise though. They never ever rebuild compromised systems they just try to improve perimeter protection.
  - srtjstjsj 5y ago
    Rebuilding the entire IT deployment is prohibitively expensive. Imagine if the solution to Covid was "the virus can spread to anyone, we need to replace all humans"
    - rjzzleep 5y ago
      When a machine/server/laptop/PC is hacked, it's considered compromised. No amount of pruning that system can restore trust in it. It needs to be reset. It's only prohibitively expensive because most of these enterprise tools and servers are actually very much focused on manual setup.
- 5y ago
pyuser583 5y ago
Fun fact: the word “security” comes from the Latin word for carelessness - “securitas.” se = without, curitas = care.
- unclewalter 5y ago
  That actually makes sense to me. If I feel secure, I feel carefree. Maybe there should be a different word when providing a secure environment from the word where people enjoy that secure environment.
- Moru 5y ago
  I wonder if the Swedish security company "Securitas" knew this when changing name. https://en.m.wikipedia.org/wiki/Securitas https://en.m.wikipedia.org/wiki/Securitas
  - pyuser583 5y ago
    I’ve often wondered this. I see them around a lot, and I’m like “someone doesn’t know their Latin.”

tokamak-teapot 5y ago

Can you explain more about the ‘root ash’ issue please?

rjzzleep 5y ago
By using some of these tools they are under the false assumption that things that are otherwise considered security threats are somehow okay because for example the tool rotates passwords for you. It gives a false sense of security and allows you to do things that would otherwise be considered security threats. It's as if someone sells you a laser that shoots intruders and tells you, you can leave the front door open from now on, but that laser only works 1 in 3 times.
- tokamak-teapot 5y ago
  I see so if people have cyberark they might feel like it’s safe to enable root logins over ssh? That does sound like the sort of thing that would happen.

Godel_unicode 5y ago

ISC² has done so much damage to the industry via enabling the fallacy of appeal to false authority it is mind-blowing. The cissp is such a terrible proof of whether someone knows anything, everyone knows it, but for some reason people keep falling for it.

mlac 5y ago
I view it as a shared level of baseline knowledge that helps with conversation. If I see someone has it, it at least tells me they understand the words I’m using and have a basic knowledge of the concepts we are discussing (or should, at least). It also tells me they are good at taking tests. It doesn’t tell me whether they understand how it all works together, or if they understand the organization’s environment, or if they are a good worker. I don’t hold it against people who fail (I’ve seen good people fail the test) or who don’t have it - I just have to ask a few more probing questions to ensure they know the tech I’m discussing. But I don’t outright ask if someone is a CISSP, so typically I ask the clarifying questions anyway so our understanding of the problem is accurate and aligned. And cert or not, I’m still more interested in whether you know what you’re doing than what you put on your resume.
- Godel_unicode 5y ago
  I wish that were true (genuinely, a shared vocab would be super useful). I've heard so many nonsensical things from CISSPs, I should really start a parody Twitter account. Did you know, for instance, that SSL is an important control for preventing SQL injection? How about that salting is not effective against rainbow tables because of the birthday paradox (yes that's actually what they said). It's just a cram-and-forget vocab test, it doesn't mean anything other than that they could afford the training and the test.
- srtjstjsj 5y ago
  Sounds like it's a test in Security Fluency, not Solution Providing.

formerly_proven 5y ago

"Centralized hosting and management (SaaS, PaaS model) has the advantage of security at scale." it follows that "Centralized hosting and management (SaaS, PaaS model) has the advantage of insecurity at scale."

arp242 5y ago

I have never understood this; the whole Enterprise™ security business talks about all these things where half the time I literally don't even know what they're on about. They all seem to take it very serious; great! And at the same time they miss basic stuff like, I don't know, subscribing to Apache struct release mailing list. Or not keeping employee credentials around on public servers used to file credit disputes. Or in the case of Solarwinds not using "solarwinds123" as a password (probably not used in the hack, but still). None of this is rocket science and these people probably aren't stupid, so somehow, somewhere, something is going horribly systemically wrong (incentives? Training? Organisation? I don't know).

smolder 5y ago
Seems like kind of a corporate/organizational culture thing. Imperfectly distributed knowledge, hierarchical decision-making in groups with misaligned incentives, the limitations of communication and the capacities of individuals... These and more make it hard to operate a large enterprise intelligently and cohesively, and oversights will happen. Corporations can certainly seem to act dumb or just learn slowly as a whole, regardless of who they're made up of. If you go bigger and look at nation-scale, the same problems are present on a greater level.
- srtjstjsj 5y ago
  Humans can't get this stuff right every time either. It's not like Colin Percival or Theo de Raadt , perfect as they are, could just audit and secure all of the Fortune 500.

cheese_van 5y ago

>These people can tell you so much about the theory of security by heart that it will make you dizzy but then won't actually understand the underlying problems. I've thought greatest failure of many professionals in this field is in the "protect the network" perspective rather than "protect the data". While many of them fess up to "we can make it difficult but not impossible" to breach the network, that is not evinced by the protections instituted. If companies actually understood that they WILL be hacked, the focus would turn to protecting the data. Actual resting data protection would allow a "I don't care if I'm hacked," posture. Either behind encryption, VM's, segregation, or architectures, preferably all, if data is actually protected, then a hack can be weathered. It's still a pain if the computer-touchers have to rebuild and reload, but that's what you pay them for. If the data is protected, a hack is just a painful exercise rather than a newsworthy event. I do understand that segregating (through protection and architecture) data is difficult, but I do not understand why it is not the focus.

rjzzleep 5y ago
I always thought that when thinking security a compromised system HAS to be rebuilt. I have never seen that happen in an enterprise though. They never ever rebuild compromised systems they just try to improve perimeter protection.
- srtjstjsj 5y ago
  Rebuilding the entire IT deployment is prohibitively expensive. Imagine if the solution to Covid was "the virus can spread to anyone, we need to replace all humans"
  - rjzzleep 5y ago
    When a machine/server/laptop/PC is hacked, it's considered compromised. No amount of pruning that system can restore trust in it. It needs to be reset. It's only prohibitively expensive because most of these enterprise tools and servers are actually very much focused on manual setup.
5y ago

pyuser583 5y ago

Fun fact: the word “security” comes from the Latin word for carelessness - “securitas.” se = without, curitas = care.

unclewalter 5y ago
That actually makes sense to me. If I feel secure, I feel carefree. Maybe there should be a different word when providing a secure environment from the word where people enjoy that secure environment.
Moru 5y ago
I wonder if the Swedish security company "Securitas" knew this when changing name. https://en.m.wikipedia.org/wiki/Securitas https://en.m.wikipedia.org/wiki/Securitas
- pyuser583 5y ago
  I’ve often wondered this. I see them around a lot, and I’m like “someone doesn’t know their Latin.”