4 ms·

In security engineering there's this subculture of individuals that just implicitly trust every vendor that offers a solution because that means they don't have

In security engineering there's this subculture of individuals that just implicitly trust every vendor that offers a solution because that means they don't have to do their own research on the issue. And if anything goes wrong, just blame the vendor! I have talked to security engineers that have had the company procure millions of dollars worth of security tools, and yet they don't even know the basics of security. For God's sake, I had to explain what end-to-end-encryption was to a team of "senior" security engineers the other day. They genuinely had no concept of it. As a security SWE I am so done with these sort of people. Fuck them! Why are they even in security!? Real private data is at risk because of their incompetency!

indigodaddy 5y ago
Many of them the extent of their knowledge is: push a button and run a scan and tell an App or Infra Team: here are your vulnerabilities now fix them. Ask them to dive in a little deeper with you on the vulnerability (Eg past the entry in the spreadsheet they gave you) and they often don’t have the technical ability to do so..
jjeaff 5y ago
It is rather appalling. I recently listened to a podcast about a police station in a small city that was compromised and all their data ransomed. They had a contract company that handled all their cyber security needs. The "security" company had an RDP port open to the world to an admin account on the server that ran everything for the police station and city. In order to protect the employees webmail, they required that you login from an internal IP and so they gave this admin remote desktop account credentials to employees that needed to check their email remotely. They could login to the server with the admin account and then use the browser on the server to log in to their webmail. The same set of root admin credentials was given to every employee. It's just insanity. And I'm sure that government contractor was hella expensive.
- username190 5y ago
  In case others are curious, that (probably) was Episode 96[0] of the "Darknet Diaries" podcast. Very worth a listen IMO. [0] https://darknetdiaries.com/episode/96/ https://darknetdiaries.com/episode/96/
sdoering 5y ago
From friends and former colleagues I know at least quite a few companies using tools like Tanium [0]. The Tanium client on the employees' machines (and on all corporate servers, containers, VMs) is still based on python 2.7. It would be interesting to know Tanium takes to backport security fixes. I mean py2.7 was sunset 2020-01-01 [1]. [0] https://www.tanium.com/ https://www.tanium.com/ [1] https://www.python.org/doc/sunset-python-2/ https://www.python.org/doc/sunset-python-2/
bikingbismuth 5y ago
I have built solutions that are a perfect fit to solve security issues at multiple companies, only to have them turned down because “management says we have to buy a vendor for this”. Incredibly frustrating, especially when they go with a vendor that is in all ways worse than the solution I was providing.
peterkelly 5y ago
I'm not sure that "security engineer" would be an accurate term to describe such a person.
mhitza 5y ago
There's a mix of "The Peter Principle", lack of experienced engineers, too expensive to acquire engineers, at play in the IT world. But as far as I recall that was always the case.
bitwize 5y ago
> I have talked to security engineers that have had the company procure millions of dollars worth of security tools, and yet they don't even know the basics of security. When I was in college the whole student network went down. Apparently there was a hack from the student network to the campus police network, so campus IT pulled the plug on any of us having network access. Because those two weren't separated because why would they be? So I hoofed it to the IT department and I asked to talk to someone who knows a thing or two about networking. The director of IT came out. He sat me down and started telling me about the $300,000 budget he just got approval on. I was thinking, you can't take some of that and stand up a router with packet filtering to isolate the student network from the police network in two different subnets? A FreeBSD box might do in a pinch. (It was the early 2000s and network traffic loads were... different.) I learned a lesson that day about seniority and the Peter Principle. Climb high enough and your mindset changes, from technical solutions to issues of money and resource allocation. From there, "let's just pay $VENDOR to do it, they'll solve the problem for us" is but a small step.
coldcode 5y ago
I worked at a company where the CIO believed everything vendors told him, and nothing any of his employees told him. He also got lots of kickbacks from said vendors and was eventually perp-walked out of the company. Same company had a head of security who was full-time employed by two different companies at the same time (he had unlimited vacation time for both) without either knowing the other existed. Best thing was that the company did investment/insurance services and had a banking division.

indigodaddy 5y ago

Many of them the extent of their knowledge is: push a button and run a scan and tell an App or Infra Team: here are your vulnerabilities now fix them. Ask them to dive in a little deeper with you on the vulnerability (Eg past the entry in the spreadsheet they gave you) and they often don’t have the technical ability to do so..

jjeaff 5y ago

It is rather appalling. I recently listened to a podcast about a police station in a small city that was compromised and all their data ransomed. They had a contract company that handled all their cyber security needs. The "security" company had an RDP port open to the world to an admin account on the server that ran everything for the police station and city. In order to protect the employees webmail, they required that you login from an internal IP and so they gave this admin remote desktop account credentials to employees that needed to check their email remotely. They could login to the server with the admin account and then use the browser on the server to log in to their webmail. The same set of root admin credentials was given to every employee. It's just insanity. And I'm sure that government contractor was hella expensive.

username190 5y ago
In case others are curious, that (probably) was Episode 96[0] of the "Darknet Diaries" podcast. Very worth a listen IMO. [0] https://darknetdiaries.com/episode/96/ https://darknetdiaries.com/episode/96/

sdoering 5y ago

From friends and former colleagues I know at least quite a few companies using tools like Tanium [0]. The Tanium client on the employees' machines (and on all corporate servers, containers, VMs) is still based on python 2.7. It would be interesting to know Tanium takes to backport security fixes. I mean py2.7 was sunset 2020-01-01 [1]. [0] https://www.tanium.com/ https://www.tanium.com/ [1] https://www.python.org/doc/sunset-python-2/ https://www.python.org/doc/sunset-python-2/

bikingbismuth 5y ago

I have built solutions that are a perfect fit to solve security issues at multiple companies, only to have them turned down because “management says we have to buy a vendor for this”. Incredibly frustrating, especially when they go with a vendor that is in all ways worse than the solution I was providing.

peterkelly 5y ago

I'm not sure that "security engineer" would be an accurate term to describe such a person.

mhitza 5y ago

There's a mix of "The Peter Principle", lack of experienced engineers, too expensive to acquire engineers, at play in the IT world. But as far as I recall that was always the case.

bitwize 5y ago

> I have talked to security engineers that have had the company procure millions of dollars worth of security tools, and yet they don't even know the basics of security. When I was in college the whole student network went down. Apparently there was a hack from the student network to the campus police network, so campus IT pulled the plug on any of us having network access. Because those two weren't separated because why would they be? So I hoofed it to the IT department and I asked to talk to someone who knows a thing or two about networking. The director of IT came out. He sat me down and started telling me about the $300,000 budget he just got approval on. I was thinking, you can't take some of that and stand up a router with packet filtering to isolate the student network from the police network in two different subnets? A FreeBSD box might do in a pinch. (It was the early 2000s and network traffic loads were... different.) I learned a lesson that day about seniority and the Peter Principle. Climb high enough and your mindset changes, from technical solutions to issues of money and resource allocation. From there, "let's just pay $VENDOR to do it, they'll solve the problem for us" is but a small step.

coldcode 5y ago

I worked at a company where the CIO believed everything vendors told him, and nothing any of his employees told him. He also got lots of kickbacks from said vendors and was eventually perp-walked out of the company. Same company had a head of security who was full-time employed by two different companies at the same time (he had unlimited vacation time for both) without either knowing the other existed. Best thing was that the company did investment/insurance services and had a banking division.