3 ms·

No, it doesn’t matter. Security can be outsourced more readily these days to company’s who make it their core offering. It’s a better solution.

by xwdv 4y ago

rhexs 4y ago
It really depends on what the security team was doing. Saying they fired the security team sounds like bad PR, but who knows. Maybe they were just running scanners and couldn't prove value to a VP.
- gwbas1c 4y ago
  I think it was 5 employees. If each cost $200,000 (salary + benefits + office space + ect,) that means Patreon was spending $1,000,000 / year. What were they doing? I worked on a major product that was known for our security benefits, and we didn't have a team of five on "security." We made sure that everyone understood best practices, and eventually had a "head of security" that oversaw our product and other products as well. So, what was the security team really doing?
  - malfist 4y ago
    lol, security and IT are similar here. If you're good at your job so there's no issues: "What are you _really_ doing?" If you're bad at your job so there's tons of issues: "What are you _really_ doing?"
kayfox 4y ago
I think fully outsourcing it really abdicates your responsibilities. There has been a long line of companies like Sony that outsourced their security and then discovered that means they have no in-house ability to respond, evaluate or supervise that outsourcing. And to be painfully honest, it also encourages coverups and lying on reports. As a security engineer at another vendor who has worked with these MSPs and their clients I have seen a lot of things that went sideways and the MSP wants to cover it up and it makes responding to an incident really hard.
- unity1001 4y ago
  > I think fully outsourcing it really abdicates your responsibilities If outsourcing credit card processing to Stripe and Paypal is not abdicating your responsibilities, that also isnt.
jjav 4y ago
> No, it doesn’t matter. There's one CISO school of thought that believes the job is to run every automated scanner they can get their hands on, report results to engineering and job is done. That can certainly all be outsourced. Another school of thought (where I inhabit) is that sure, you need to do that, but to really have a secure product or service it has to be built ground-up with security as a core requirement. You can't outsource that (ok you could but it means having expensive consultants sitting in with the engineering teams day to day, at which point it's far cheaper to have an in-house security team).

No, it doesn’t matter. Security can be outsourced more readily these days to company’s who make it their core offering. It’s a better solution.

by xwdv 4y ago

No, it doesn’t matter. Security can be outsourced more readily these days to company’s who make it their core offering. It’s a better solution.

rhexs 4y ago

It really depends on what the security team was doing. Saying they fired the security team sounds like bad PR, but who knows. Maybe they were just running scanners and couldn't prove value to a VP.

gwbas1c 4y ago
I think it was 5 employees. If each cost $200,000 (salary + benefits + office space + ect,) that means Patreon was spending $1,000,000 / year. What were they doing? I worked on a major product that was known for our security benefits, and we didn't have a team of five on "security." We made sure that everyone understood best practices, and eventually had a "head of security" that oversaw our product and other products as well. So, what was the security team really doing?
- malfist 4y ago
  lol, security and IT are similar here. If you're good at your job so there's no issues: "What are you _really_ doing?" If you're bad at your job so there's tons of issues: "What are you _really_ doing?"

kayfox 4y ago

I think fully outsourcing it really abdicates your responsibilities. There has been a long line of companies like Sony that outsourced their security and then discovered that means they have no in-house ability to respond, evaluate or supervise that outsourcing. And to be painfully honest, it also encourages coverups and lying on reports. As a security engineer at another vendor who has worked with these MSPs and their clients I have seen a lot of things that went sideways and the MSP wants to cover it up and it makes responding to an incident really hard.

unity1001 4y ago
> I think fully outsourcing it really abdicates your responsibilities If outsourcing credit card processing to Stripe and Paypal is not abdicating your responsibilities, that also isnt.

jjav 4y ago

> No, it doesn’t matter. There's one CISO school of thought that believes the job is to run every automated scanner they can get their hands on, report results to engineering and job is done. That can certainly all be outsourced. Another school of thought (where I inhabit) is that sure, you need to do that, but to really have a secure product or service it has to be built ground-up with security as a core requirement. You can't outsource that (ok you could but it means having expensive consultants sitting in with the engineering teams day to day, at which point it's far cheaper to have an in-house security team).