5 ms·

> If your threat model includes... At my Fortune 250, our threat model apparently includes -- rather conveniently and coincidentally -- everything! Well, every

> If your threat model includes... At my Fortune 250, our threat model apparently includes -- rather conveniently and coincidentally -- everything! Well, everything they make an off-the-shelf product for, anyway. It makes new purchasing decisions easy: "Does your product make any thing, in any way, more secure?" "Uh... Yes?" "You son of a bitch. We're in. Roll it out everywhere. Now."

Macha 3y ago
Ahh, I've been there. I'm sure no concern is given for usability of the result. Welding your vault shut may make it harder for thieves to break in, but if your business model requires making deposits and withdrawals, it's somewhat less helpful.
- lazide 3y ago
  Luckily, all but tiny portion of security products have a door you can open if you ask support nicely enough you didn’t know about before. So you can still get your stuff after you weld the door shut.
calgoo 3y ago
And then when there is a security issue you ask them share the log files from all their spyware and suddenly half the stuff needed is not there because we did not get that module.
- lazide 3y ago
  Or ‘oh, that feature hasn’t been rolled out yet, expect it in 6 quarters.’.
hiatus 3y ago
There's no thought given to if the cost to secure the thing outweighs the risk of exposure?
- deleted 3y ago
  [deleted]
- TheRealDunkirk 3y ago
  I’m not privy to those discussions, but it certainly doesn’t feel like they’re happening. We implement every security “best practice,” for every project, no matter how big or small. We have committees to review, but not to assess scope, only to make sure everything is applied to everything. Also, we have multiple overlapping security products on the corporate desktop image. It feels EXACTLY like no one has ever tried to gauge what a compromise might cost.
jdwithit 3y ago
This reminds me of our own security team, who as far as I can tell do nothing but run POC's of new security tools. And then maybe once a year actually buy one, generating a ton of work (for others) to replace the very similar tool they bought last year. Seems like a good gig.
- Bluecobra 3y ago
  And the sad/funny thing is that said tool would probably do diddly squat if one employee falls for a social engineering/phishing attack.
  - oefrha 3y ago
    Occasionally security products turn into malware delivery platforms as well, because they run very privileged, are sometimes more shoddily developed than what they’re protecting, and have fewer eyeballs on them than the vanilla operating system. Not to mention they may be another Crypto AG.
    - jacquesm 3y ago
      > Occasionally Much more frequently than that if you lump 'anti virus software' in with security products.
  - Prickle 3y ago
    As someone who's company just suffered this exact issue, all I can say is yes. They gave me a laptop with 8gb of ram. The laptop runs invisible security software that nominally takes 6~6.8gb. We just got penetrated by two attackers in the last 40 days.
    - formerly_proven 3y ago
      > We just got penetrated by two attackers in the last 40 days. * that you know of

Macha 3y ago

Ahh, I've been there. I'm sure no concern is given for usability of the result. Welding your vault shut may make it harder for thieves to break in, but if your business model requires making deposits and withdrawals, it's somewhat less helpful.

lazide 3y ago
Luckily, all but tiny portion of security products have a door you can open if you ask support nicely enough you didn’t know about before. So you can still get your stuff after you weld the door shut.

calgoo 3y ago

And then when there is a security issue you ask them share the log files from all their spyware and suddenly half the stuff needed is not there because we did not get that module.

lazide 3y ago
Or ‘oh, that feature hasn’t been rolled out yet, expect it in 6 quarters.’.

hiatus 3y ago

There's no thought given to if the cost to secure the thing outweighs the risk of exposure?

deleted 3y ago
[deleted]
TheRealDunkirk 3y ago
I’m not privy to those discussions, but it certainly doesn’t feel like they’re happening. We implement every security “best practice,” for every project, no matter how big or small. We have committees to review, but not to assess scope, only to make sure everything is applied to everything. Also, we have multiple overlapping security products on the corporate desktop image. It feels EXACTLY like no one has ever tried to gauge what a compromise might cost.

jdwithit 3y ago

This reminds me of our own security team, who as far as I can tell do nothing but run POC's of new security tools. And then maybe once a year actually buy one, generating a ton of work (for others) to replace the very similar tool they bought last year. Seems like a good gig.

Bluecobra 3y ago
And the sad/funny thing is that said tool would probably do diddly squat if one employee falls for a social engineering/phishing attack.
- oefrha 3y ago
  Occasionally security products turn into malware delivery platforms as well, because they run very privileged, are sometimes more shoddily developed than what they’re protecting, and have fewer eyeballs on them than the vanilla operating system. Not to mention they may be another Crypto AG.
  - jacquesm 3y ago
    > Occasionally Much more frequently than that if you lump 'anti virus software' in with security products.
- Prickle 3y ago
  As someone who's company just suffered this exact issue, all I can say is yes. They gave me a laptop with 8gb of ram. The laptop runs invisible security software that nominally takes 6~6.8gb. We just got penetrated by two attackers in the last 40 days.
  - formerly_proven 3y ago
    > We just got penetrated by two attackers in the last 40 days. * that you know of