4 ms·
> But giving the keys to the castle to some mid-tier company is just a recipe for disaster It sucks, because I know my company is quite small but we take secur
by staticassertion 5y ago
> But giving the keys to the castle to some mid-tier company is just a recipe for disaster
It sucks, because I know my company is quite small but we take security extremely seriously (we have 9 people, 4 are security engineers, and the other 5 have varying degrees of experience in security). I think people might worry that, because of our size, we won't be as secure as a larger company. But the irony is that larger companies are often far less secure than us, because we've done shit right from day 1.
There's just not a lot of ways to prove it. Compliance is meaningless. You could get a pentest report, but it really comes down to who's doing the pentest, and so if your pentest becomes a public doc the incentive is to have them go easy on you - not to mention that lots of reports contain "findings" that are nonsense but a casual reader might misunderstand.
We plan to give talks and blog about how companies at our stage can do things that would make companies 100x our size jealous, because that's kinda the only thing we can do to really explain that it's possible.
I think it's totally criminal that companies ask for RCE on all of your devices and then push out some closed source C++ app that's probably parsing all sorts of random shit, reading poorly authorized commands from some C2, etc.
- shandor 5y ago> We plan to give talks and blog about how companies at our stage can do things that would make companies 100x our size jealous Sounds interesting and rather extraordinary, would be great to read more on your thoughts on that. Do you refer to the Grapl blog?
- staticassertion 5y agoYeah, I'd say watch the blog, I have some draft posts written up.
- PenguinCoder 5y agoMuch easier to do it Ina small company, very hard to get it right in a company "100x your size".
- staticassertion 5y agoI wasn't trying to say otherwise - it's a huge advantage to be this size, with regards to security. It would have taken me years at Dropbox to accomplish things that take a weekend now.
- srtjstjsj 5y agoI wouldn't trust a company that implements security critical projects on the weekend...
- staticassertion 5y agoI think you're probably misunderstanding. As an example, rolling out a policy at a company with thousands of people has to be done slowly and incrementally, with buy-in across teams, etc. To do the same is trivial at a small company. What would take years and lots of effort becomes something you can do in spare time. Of course, we put considerably time into security, it's not just something that one does once in a while with spare time. The point is that we can go much much faster.
- _wldu 5y agoThis really gets at the issue. These are compliance tools mandated by auditors and accountants that are intended to provide centralized config/control of everything. Ultimately, they make companies insecure as they have tentacles into everything important. They are used against the companies (by hackers). That should not surprise anyone. You can be compliant and buy insurance or you can be secure. Pick one.