3 ms·

Sounds like they’ve hired a MSSP. Won’t be the same if they’re a tech company and overall it’s the wrong trend to actually get a secure vs compliant platform. M

Sounds like they’ve hired a MSSP. Won’t be the same if they’re a tech company and overall it’s the wrong trend to actually get a secure vs compliant platform. MSSPs are a step above offshoring your whole security team, so not a great bit of news. The average windows enterprise customer who uses MSFT for 60% of the security load and 40% to the MSSP and IT team can get by with this move. But, knowing people who work at MSSP, a lot of security theater goes on because it’s just on the wrong side of industry trends. Watching is one thing, fixing it is the other. They prob has some cost cutting and a CISO or equivalent who didn’t know how to make the case (or no CISO).

danielmarkbruce 4y ago
Some of the MDRs seem good. Red Canary for example.
- lmeyerov 4y ago
  I see a lot of companies successful via a long-running relationship with MSSPs for improving help desk style support and occasional emergency forensics etc. That's been getting more interesting, and as we partner with MSSP ourselves (graph ai, GPU, etc tech), been awesome to see how that enables investments that are too hard at the individual company levels. For SMB, even more sensible. But at SME/enterprise scales, a lot of the success is driven by in-housing tier 2 + security engineering. For tech/product companies, true at even smaller scales. Security is part of a common core product value proposition for the customer: trust baked in. Same but different for say fraud & safety and how that relates to account churn vs growth. Seeing that capability evaporate is scary. As an analogy, most companies who handed over control of their data plane to palantir engineers & proprietary palantir infra ended up regretting it and wanting to change the relationship. Areas like parts of the US Gov who haven't are now stuck. Doing the same with the trust & risk aspects of an enterprise is scary, especially as each one is now increasingly part tech company.
  - danielmarkbruce 4y ago
    Yup, I'm sure that's right. That being said, I don't doubt a good arrangement can be had with someone like Red Canary to provide services of tier 2 and 3. I've only spoken with them and not other leading MDRs so I'm not sure as to the quality of others. I can easily see a company like Patreon making the decision to use an MDR and it being the right call.
- dogman144 4y ago
  Agreed, good vendors and the related teams. I’d def trust Crowdstrike L1 triage. The problems show up with 3rd parties running a suite of EDRs across a spread of customers.
- PragmaticPulp 4y ago
  Some of them are very good, and accordingly very expensive. A non-exhaustive look through the LinkedIn profiles of the former security team doesn't show any previous startup-to-IPO security experience. If Patreon is preparing the company for eventual IPO, getting everything security-related aligned with the due diligence expected for an IPO is critical. I would guess Patreon is simply engaging with an external firm that has past experience preparing security at a company for IPO. The laid off security team might have been otherwise good engineers, but not necessarily the right team needed to prep a company for IPO.
  - dogman144 4y ago
    A fun exercise is scouting the sec eng numbers and tenure of a pre-IPO shop, or of more concern vendors that are all over product teams. Big yikes
  - wink 4y ago
    The probability of your whole team not being the right people is very low to begin with, and you kinda have to assume none of them would be up for the task of growing into that role, with external support. Sure. I dunno, either all they did is actually covered by developers and ops, or they're getting rid of a lot institutional knowledge.

danielmarkbruce 4y ago

Some of the MDRs seem good. Red Canary for example.

lmeyerov 4y ago
I see a lot of companies successful via a long-running relationship with MSSPs for improving help desk style support and occasional emergency forensics etc. That's been getting more interesting, and as we partner with MSSP ourselves (graph ai, GPU, etc tech), been awesome to see how that enables investments that are too hard at the individual company levels. For SMB, even more sensible. But at SME/enterprise scales, a lot of the success is driven by in-housing tier 2 + security engineering. For tech/product companies, true at even smaller scales. Security is part of a common core product value proposition for the customer: trust baked in. Same but different for say fraud & safety and how that relates to account churn vs growth. Seeing that capability evaporate is scary. As an analogy, most companies who handed over control of their data plane to palantir engineers & proprietary palantir infra ended up regretting it and wanting to change the relationship. Areas like parts of the US Gov who haven't are now stuck. Doing the same with the trust & risk aspects of an enterprise is scary, especially as each one is now increasingly part tech company.
- danielmarkbruce 4y ago
  Yup, I'm sure that's right. That being said, I don't doubt a good arrangement can be had with someone like Red Canary to provide services of tier 2 and 3. I've only spoken with them and not other leading MDRs so I'm not sure as to the quality of others. I can easily see a company like Patreon making the decision to use an MDR and it being the right call.
dogman144 4y ago
Agreed, good vendors and the related teams. I’d def trust Crowdstrike L1 triage. The problems show up with 3rd parties running a suite of EDRs across a spread of customers.
PragmaticPulp 4y ago
Some of them are very good, and accordingly very expensive. A non-exhaustive look through the LinkedIn profiles of the former security team doesn't show any previous startup-to-IPO security experience. If Patreon is preparing the company for eventual IPO, getting everything security-related aligned with the due diligence expected for an IPO is critical. I would guess Patreon is simply engaging with an external firm that has past experience preparing security at a company for IPO. The laid off security team might have been otherwise good engineers, but not necessarily the right team needed to prep a company for IPO.
- dogman144 4y ago
  A fun exercise is scouting the sec eng numbers and tenure of a pre-IPO shop, or of more concern vendors that are all over product teams. Big yikes
- wink 4y ago
  The probability of your whole team not being the right people is very low to begin with, and you kinda have to assume none of them would be up for the task of growing into that role, with external support. Sure. I dunno, either all they did is actually covered by developers and ops, or they're getting rid of a lot institutional knowledge.