4 ms·
I mean, it sounds bad, but in a lot of those small companies, the security team is actually dead weight / just for show. A bunch of guys running automated scans
by i_have_an_idea 4y ago
I mean, it sounds bad, but in a lot of those small companies, the security team is actually dead weight / just for show. A bunch of guys running automated scans with Rapid7 / Crowdstrike, looking at pretty dashboard graphs and sending managers scary "intrusion alert" emails because someone tried to SSH on 22 but failed.
Obviously, we don't know if that's the case here, but I wish more companies figured out their security team is security theatre.
- lazyasciiart 4y agoMy security team is deadweight. They once tried to create a sev-1 incident when a customer complained that if they typed a password on the command line while trying to call our program, it got saved in session logs.
- orf 4y agoOurs started a sev-1 and pulled my whole team into incident response mode after AWS guard duty told them some account credentials where used outside our VPC. It was a member of their team doing a pentest they organized.
- deleted 4y ago[deleted]
- josephcsible 4y agoAren't most security teams scapegoated if their company gets harmed by being hacked, but let off the hook if their company gets harmed by overly zealous security rules? And doesn't this incentivize them all to be way too risk-averse and even paranoid?