3 ms·

I assumed you worked in infosec, so no surprise there. What is surprising is that you're essentially claiming clients primarily need only take a couple of measu

I assumed you worked in infosec, so no surprise there. What is surprising is that you're essentially claiming clients primarily need only take a couple of measures that you imply to be trivial, so they are negligent if they are breached. Aside from the obvious wrongness of that mind-boggling assertion, it raises the question for even the uninformed as to why there would be a multi-billion dollar infosec industry--that includes your company--if security is as trivial as you suggest here. Of course, the answer is that it is not and that you should understand better than most the complexity inherent to infosec, else you wouldn't have a business. Perhaps that's why, of the people I know who work in infosec, not a single one is as cavalier as you appear to be here. But, here you're again underscoring my point by focusing solely on the victim's "culpability" and now even claiming that they are not actual victims. Victim-blaming is a standard propaganda technique propagated by the criminals and their sponsors. Why are you working so hard to oblige them with these odd false narratives?

goldenkey 5y ago
I've been doing infosec since I was 10. That's why I know a teenager can rip apart billion dollar companies. Just take a look at the audience of any 2600 or Defcon meetup. 90% of these people were tearing shit up since they were a kid. In fact, I was a better hacker when I was younger, because I had more time to experiment and learn new things. I know this all comes as a surprise to a bootcamp or C.S grad, but you are not representative.
- unclebucknasty 5y ago
  We're being attacked by organized criminals, sponsored by hostile nation-states, not your imaginary teenagers. The point is that we should defend our companies and economies by responding vigorously against the criminals and their national sponsors with law enforcement and aggressive offensive cyber capabilities. They need a smack in the mouth every time they touch any of our citizens or the companies for which they work. These are costly direct attacks on our national security, economic prosperity, and infrastructure that are followed up with classic Russian-style propaganda, intended to minimize and redirect blame to the victims. That propaganda is then propagated by trolls and useful idiots. And, here you are with your victim-blaming and minimizing strawman claims about teenagers and boogeymen.
staticassertion 5y ago
> What is surprising is that you're essentially claiming clients primarily need only take a couple of measures that you imply to be trivial, so they are negligent if they are breached. Yes, you can be safe against the vast majority of threats with just a few trivial measures. > it raises the question for even the uninformed as to why there would be a multi-billion dollar infosec industry--that includes your company--if security is as trivial as you suggest here There are a number of reasons. While you can eliminate phishing and malware pretty trivially, and secure your organization against the vast majority of threats, there sometimes holes you'll need to poke. Things like giving HR the ability to open word docs with macros enabled, or running multiple clouds, or providing RCE as a service, etc. But the vast majority of attacks can be stopped pretty easily. Over 95% of malware samples execute out of a single directory - blocking execution in that directory therefor breaks 95% of malware samples. Obviously there's a ton of malware left in that last 5%, but 95% isn't nothing. Why don't companies block that 95%? > But, here you're again underscoring my point by focusing solely on the victim's "culpability" and now even claiming that they are not actual victims. Again, individuals can be victims, corporations take on the additional responsibility when they are formed. A corporation that takes data from its users and then loses it is not the victim, the end users are. This is legally and morally the case. When you form a corporation you literally, legally sign up for a number of responsibilities that a normal person does not have. When you take data from users you are morally (and, again, legally) signing up to protect that data.
- unclebucknasty 5y ago
  Your comments are summable with, "95% of attacks can be trivially thwarted by doing x, and there's other stuff we can do for the other 95%." These are unserious, self-contradicting arguments, intended to muddle the issue. You're making inane statements that suggest infosec is trivial, then slowly ceding that it's not, while pivoting back to redirecting blame to the targeted companies. The fact that corporations sign up to take on responsibility doesn't make them any less victims when they're attacked. In sum, you're going to ridiculous lengths to absolve the actual criminals here by moving blame to the victims. We should all be angry at the companies, not the actual criminals. This is a preferred misdirection technique, promulgated by Russian propagandists and the useful idiots who regurgitate them.

goldenkey 5y ago

I've been doing infosec since I was 10. That's why I know a teenager can rip apart billion dollar companies. Just take a look at the audience of any 2600 or Defcon meetup. 90% of these people were tearing shit up since they were a kid. In fact, I was a better hacker when I was younger, because I had more time to experiment and learn new things. I know this all comes as a surprise to a bootcamp or C.S grad, but you are not representative.

unclebucknasty 5y ago
We're being attacked by organized criminals, sponsored by hostile nation-states, not your imaginary teenagers. The point is that we should defend our companies and economies by responding vigorously against the criminals and their national sponsors with law enforcement and aggressive offensive cyber capabilities. They need a smack in the mouth every time they touch any of our citizens or the companies for which they work. These are costly direct attacks on our national security, economic prosperity, and infrastructure that are followed up with classic Russian-style propaganda, intended to minimize and redirect blame to the victims. That propaganda is then propagated by trolls and useful idiots. And, here you are with your victim-blaming and minimizing strawman claims about teenagers and boogeymen.

staticassertion 5y ago

> What is surprising is that you're essentially claiming clients primarily need only take a couple of measures that you imply to be trivial, so they are negligent if they are breached. Yes, you can be safe against the vast majority of threats with just a few trivial measures. > it raises the question for even the uninformed as to why there would be a multi-billion dollar infosec industry--that includes your company--if security is as trivial as you suggest here There are a number of reasons. While you can eliminate phishing and malware pretty trivially, and secure your organization against the vast majority of threats, there sometimes holes you'll need to poke. Things like giving HR the ability to open word docs with macros enabled, or running multiple clouds, or providing RCE as a service, etc. But the vast majority of attacks can be stopped pretty easily. Over 95% of malware samples execute out of a single directory - blocking execution in that directory therefor breaks 95% of malware samples. Obviously there's a ton of malware left in that last 5%, but 95% isn't nothing. Why don't companies block that 95%? > But, here you're again underscoring my point by focusing solely on the victim's "culpability" and now even claiming that they are not actual victims. Again, individuals can be victims, corporations take on the additional responsibility when they are formed. A corporation that takes data from its users and then loses it is not the victim, the end users are. This is legally and morally the case. When you form a corporation you literally, legally sign up for a number of responsibilities that a normal person does not have. When you take data from users you are morally (and, again, legally) signing up to protect that data.

unclebucknasty 5y ago
Your comments are summable with, "95% of attacks can be trivially thwarted by doing x, and there's other stuff we can do for the other 95%." These are unserious, self-contradicting arguments, intended to muddle the issue. You're making inane statements that suggest infosec is trivial, then slowly ceding that it's not, while pivoting back to redirecting blame to the targeted companies. The fact that corporations sign up to take on responsibility doesn't make them any less victims when they're attacked. In sum, you're going to ridiculous lengths to absolve the actual criminals here by moving blame to the victims. We should all be angry at the companies, not the actual criminals. This is a preferred misdirection technique, promulgated by Russian propagandists and the useful idiots who regurgitate them.