4 ms·

Fully agree with the author, the often quoted CIA (Confidentiality Integrity Availability) actually belongs to the SRE platform's concern. What I often see how

by slt2021 3y ago

Fully agree with the author, the often quoted CIA (Confidentiality Integrity Availability) actually belongs to the SRE platform's concern. What I often see however, is SRE teams keep extremely understaffed (because "cost center") and often outsourced to offshore contractor in India - this basically means you can only keep the lights on via SRE team and cannot do anything else. If you have a competent and fully staffed SRE Platform engineering team - you will NOT need a separate cybersecurity team. But if company decided to cut costs on SRE folks, they then will have to invest heavily in cybersecurity team. At least because of mandated regulation (FedRAMP SOX HIPAA GDPR compliance disclosure etc) - it is easier to justify cyber budget, than the SRE budget Plus recent laws mandate having CISO as a high level executive (chief incident scapegoat officer) with huge budget and disclosure of recent hacks etc

pizzalife 3y ago
>If you have a competent and fully staffed SRE Platform engineering team - you will NOT need a separate cybersecurity team. So the SRE team is supposed to find vulnerabilities in the codebase and pentest the network?
- slt2021 3y ago
  I am gonna surprise you, but nobody from cybersecurity is finding vulnerabilities either. ALL of cybersecurity is just operating and configuring a platform, whether it is Qualys or Snyk or Wiz or something else. "cyber" people are basically TOOL MONKEYS, and if SRE people can handle operating and configuring kubernetes - they sure as hell are capable of operating and configuring Qualys and Snyk and Wyz platforms. Pentest is the same, I have not met any inhouse dedicated pentest folks, it is always third party contractor hired as needed for a short period of time. All inhouse fulltime cyber engineers are dedicated to blue team operations, rather than red team operations.
  - opt-skept 3y ago
    As part of the industry, I can tell you I've personally found dozens (hundreds?) of vulnerabilities per year for the more than decade running of my career. The same is true of my collegues. I have met "cybersecurity teams" who are "tool monkeys" in the way you suggest. Usually these individuals are part of an extended compliance team. They are trying to check compliance boxes by having some level of automated scanning, because their parent organization/team can't/won't staff professionals capable of this or capable of scaling it or focusing attention on where it matters. I don't want to oust you for where you work or your role within those companies - but really surprised to hear that there's no inhouse pentesting and no in house red teaming. I haven't worked at a company yet (on my fourth) that matches the experience you described.
    - slt2021 3y ago
      a lot of your suggested vulnerabilities could be prevented from appearing if company just hired a person who can configure SAST and WAF and etc solutions (solving a class of security problems from showing up on a platform level, not on per each vulnerability instance level). Why rely on an in-house redteamer who may find one or two vulns per year, or may not.
      - opt-skept 3y ago
        Eh... maybe. I think "configuring SAST" goes back to what you had previously said about "tool monkeys". Now there's thousands of potential issues. Many are false positives. Who is going to tune that SAST for accuracy rate? What about vulnerabilities that are framework specific? Will the SAST even allow for this? Who is responsible for triaging all of these alerts? Are they capable of correctly addressing them? If you just set up SAST and walk away, you end up with more noise than you do signal. And you created the need for security professionals to process the results. I think the article had better suggestions for scalable security, for example #3 Build standardized patterns and #7 Provide isolation patterns. Better to systematically prevent SQLi with a platform/library than try to detect all variations of SQLi with SAST! WAF? It's something I would put in front of a product I have confidence in as a defense-in-depth. But would I rely on it as the sole security investment? Absolutely not. The reason is not all vulnerabilities are web-based, and many do not have differentially detectable payloads (missing authz on an API isn't going to get caught by WAF). Why Red Team? Because the leading way businesses get compromises is with phishing attacks. A security team needs to ensure application security, network security AND operation security. A SAST or WAF aren't going to do that. Neither with Qualys, etc.
  - surge 3y ago
    I'm a full time red team. Depends on your org, but you're not ready for a red team until you get the basics of blue straight. Most of our blue is threat and anomaly detection. They spend a lot of time in tools, sure but its usually a SIEM like Splunk or similar tools for event correlation and behavior detection like Crowdstrike. Qualys isn't going to find custom written malware using common utility as a C2 channel.
    - slt2021 3y ago
      >Qualys isn't going to find custom written malware using common utility as a C2 channel. yeah, but crowdstike or whatever antivirus you use can. Again, no need for red team, just an operator for Security Tool X/Y/Z
      - HotPotato787 3y ago
        >yeah, but crowdstike or whatever antivirus you use can. ...No, it really can't. Not all of the time. It doesn't understand your business logic behind your architecture, it doesn't know how to separate normal from anomalous behaviour (yes, even if you have XtremeAI or whatever the vendor peddled to you), it cannot correlate alerts and activites in patterns not explicitly programmed and it can't generate alerts with 100% precision. In short, it's not intelligent.
        slt2021 3y ago
        thats not the job of red team, this is blue team work (Detection Engineering or Incident Response or Security Operations whatever they are called) - a SIEM tool monkey basically. again, no need for a fulltime red teamer
        surge 3y ago
        I don't think you know what the point of a red team is, if you did you'd understand how oxymoronic your statement is. A part time red teamer is just a pen tester. That's not what a red team does, and adequate threat emulation isn't someone who flies in for two weeks does somethings that you can only accomplish in two weeks, then fly out to the next company to do the same things. You actually need to dig deep and research a companies individual weaknesses and that takes time. Threat actors have that kind of time to sit and observe and probe, a part time noisy pen test isn't going to get you more than the basics. Also a blue team has to be right all the time, the attacker only has to get things right once. That's why you constantly test your assumptions with a red team and give blue someone to "train" with and improve with that isn't an actual threat actor. You don't want the first time you fight to be in the ring, you need to spar. A lot of pen testing consultancies brand themselves as red teams, but a lot of them are just rebranding pen testing services to the ignorant.
  - m000 3y ago
    > "cyber" people are basically TOOL MONKEYS That was also my short experience in the area, and it was boring AF, almost soulcrushing. Maybe I just got unlucky, but it feels that a lot of security engineering positions are like that. Would anyone happen to know of what search terms should one use to find open positions that are focused on security tool building rather than deploying a purchased solution?
    - slt2021 3y ago
      Security jobs are tiered: Tier0: Pure security research shops, like Google Project Zero and alike. YOu can only get this job after doing PhD in Computer Security at top-tier university lab, and have publications on stuff like linux kernel fuzzing, have 10+ linux CVEs under your belt, and listed as contributor to a well-known open-source security tool. Tier1: top security vendors: crowdstrike zs qualys pan cisco and etc. R&D (or Business Unit) departments responsible for developing security product features and maintaining security content. Tier2: FAANG and adjacent cloud-native companies, job title "security software engineer" or "security engineer" or "$platform_name engineer" or "cloudsec/appsec engineer" Tier3: pre-IPO unicorns which are hiring for Product Security and AppSecurity positions ... Tier10+: all other public companies, regular S&P500 infosec department. the general rule is the higher the salary the more demanding the job will be and the tougher is competition to get that job
  - kstrauser 3y ago
    > I am gonna surprise you, but nobody from cybersecurity is finding vulnerabilities either. My recent interview as a security engineer had distinct sections for software review and for architecture analysis. My last job had me running Burp Suite once a month (because it was fun and I didn't mind doing it), but that was roughly 30 minutes every 4 weeks. Sounds like you've worked with some quite junior security teams.
    - slt2021 3y ago
      interview vs real work is different. FAANG engineers are not flipping a binary tree either, yet this is a common question they ask. as for Burp Suite - why would a company keep engineer full-time only for him to run burp suite for 30 minutes once a month? Sounds like poor investment on a company's side.
      - kstrauser 3y ago
        > interview vs real work is different. ...or, and hear me out, maybe some companies are more proactive about their security. Craziness, I know, but maybe! > why would a company keep engineer full-time only for him to run burp suite for 30 minutes once a month? Uh, I was doing other things the other 159.5 hours a month.
        slt2021 3y ago
        so you agree that it is cheaper and better to ask SRE team to run BurpSuite for 30 minutes once a week, rather than hiring FTE to do that?
        kstrauser 3y ago
        I honestly have no idea what you're trying to say.
  - pizzalife 3y ago
    >I am gonna surprise you, but nobody from cybersecurity is finding vulnerabilities either. Well, no. I work in "cybersecurity" and my day job is literally finding vulnerabilities.
HotPotato787 3y ago
> If you have a competent and fully staffed SRE Platform engineering team - you will NOT need a separate cybersecurity team. Not all cybersecurity problems are platform problems, or even technical problems. Even if you decide to gather all AppSec/InfraSec engineers inside of SRE/SysAdmin, this creates two problems: 1 - They are now separate from the main cybersecurity team, which is solving other problems and that in turn creates all sorts of issues ranging from lack of coordination to managerial ones. 2 - This creates a HUGE lack of separation of duties (or a conflict of interest). The executor of a task should never be the auditor of a task. You cannot expect the SRE team to go out of their way to keep finding flaws in their own work and exposing them to the board so they can be forced to reprioritize and fix these flaws. The SRE can and should have security built-in as much as possible, but an external team is still required.
- slt2021 3y ago
  SRE is really a more familiar "sysadmin" from good ole days. You know, that bearded IT guru in a basement floor, will curse and shout at you, but will keep your company running when it comes to IT. if you switch back to sysadmin model - having a single sysadmin do all the SRE and security work, divided per platform, then separate security is indeed feel like extra. You can obviously hire independent third party security auditors and do pentest, but that thing could be done once a year. Often times your financial auditors (Big 4 accounting firms) will offer IT audit and pentest in a bundle and you can get a good deal.

pizzalife 3y ago

>If you have a competent and fully staffed SRE Platform engineering team - you will NOT need a separate cybersecurity team. So the SRE team is supposed to find vulnerabilities in the codebase and pentest the network?

slt2021 3y ago
I am gonna surprise you, but nobody from cybersecurity is finding vulnerabilities either. ALL of cybersecurity is just operating and configuring a platform, whether it is Qualys or Snyk or Wiz or something else. "cyber" people are basically TOOL MONKEYS, and if SRE people can handle operating and configuring kubernetes - they sure as hell are capable of operating and configuring Qualys and Snyk and Wyz platforms. Pentest is the same, I have not met any inhouse dedicated pentest folks, it is always third party contractor hired as needed for a short period of time. All inhouse fulltime cyber engineers are dedicated to blue team operations, rather than red team operations.
- opt-skept 3y ago
  As part of the industry, I can tell you I've personally found dozens (hundreds?) of vulnerabilities per year for the more than decade running of my career. The same is true of my collegues. I have met "cybersecurity teams" who are "tool monkeys" in the way you suggest. Usually these individuals are part of an extended compliance team. They are trying to check compliance boxes by having some level of automated scanning, because their parent organization/team can't/won't staff professionals capable of this or capable of scaling it or focusing attention on where it matters. I don't want to oust you for where you work or your role within those companies - but really surprised to hear that there's no inhouse pentesting and no in house red teaming. I haven't worked at a company yet (on my fourth) that matches the experience you described.
  - slt2021 3y ago
    a lot of your suggested vulnerabilities could be prevented from appearing if company just hired a person who can configure SAST and WAF and etc solutions (solving a class of security problems from showing up on a platform level, not on per each vulnerability instance level). Why rely on an in-house redteamer who may find one or two vulns per year, or may not.
    - opt-skept 3y ago
      Eh... maybe. I think "configuring SAST" goes back to what you had previously said about "tool monkeys". Now there's thousands of potential issues. Many are false positives. Who is going to tune that SAST for accuracy rate? What about vulnerabilities that are framework specific? Will the SAST even allow for this? Who is responsible for triaging all of these alerts? Are they capable of correctly addressing them? If you just set up SAST and walk away, you end up with more noise than you do signal. And you created the need for security professionals to process the results. I think the article had better suggestions for scalable security, for example #3 Build standardized patterns and #7 Provide isolation patterns. Better to systematically prevent SQLi with a platform/library than try to detect all variations of SQLi with SAST! WAF? It's something I would put in front of a product I have confidence in as a defense-in-depth. But would I rely on it as the sole security investment? Absolutely not. The reason is not all vulnerabilities are web-based, and many do not have differentially detectable payloads (missing authz on an API isn't going to get caught by WAF). Why Red Team? Because the leading way businesses get compromises is with phishing attacks. A security team needs to ensure application security, network security AND operation security. A SAST or WAF aren't going to do that. Neither with Qualys, etc.
- surge 3y ago
  I'm a full time red team. Depends on your org, but you're not ready for a red team until you get the basics of blue straight. Most of our blue is threat and anomaly detection. They spend a lot of time in tools, sure but its usually a SIEM like Splunk or similar tools for event correlation and behavior detection like Crowdstrike. Qualys isn't going to find custom written malware using common utility as a C2 channel.
  - slt2021 3y ago
    >Qualys isn't going to find custom written malware using common utility as a C2 channel. yeah, but crowdstike or whatever antivirus you use can. Again, no need for red team, just an operator for Security Tool X/Y/Z
    - HotPotato787 3y ago
      >yeah, but crowdstike or whatever antivirus you use can. ...No, it really can't. Not all of the time. It doesn't understand your business logic behind your architecture, it doesn't know how to separate normal from anomalous behaviour (yes, even if you have XtremeAI or whatever the vendor peddled to you), it cannot correlate alerts and activites in patterns not explicitly programmed and it can't generate alerts with 100% precision. In short, it's not intelligent.
      - slt2021 3y ago
        thats not the job of red team, this is blue team work (Detection Engineering or Incident Response or Security Operations whatever they are called) - a SIEM tool monkey basically. again, no need for a fulltime red teamer
        surge 3y ago
        I don't think you know what the point of a red team is, if you did you'd understand how oxymoronic your statement is. A part time red teamer is just a pen tester. That's not what a red team does, and adequate threat emulation isn't someone who flies in for two weeks does somethings that you can only accomplish in two weeks, then fly out to the next company to do the same things. You actually need to dig deep and research a companies individual weaknesses and that takes time. Threat actors have that kind of time to sit and observe and probe, a part time noisy pen test isn't going to get you more than the basics. Also a blue team has to be right all the time, the attacker only has to get things right once. That's why you constantly test your assumptions with a red team and give blue someone to "train" with and improve with that isn't an actual threat actor. You don't want the first time you fight to be in the ring, you need to spar. A lot of pen testing consultancies brand themselves as red teams, but a lot of them are just rebranding pen testing services to the ignorant.
- m000 3y ago
  > "cyber" people are basically TOOL MONKEYS That was also my short experience in the area, and it was boring AF, almost soulcrushing. Maybe I just got unlucky, but it feels that a lot of security engineering positions are like that. Would anyone happen to know of what search terms should one use to find open positions that are focused on security tool building rather than deploying a purchased solution?
  - slt2021 3y ago
    Security jobs are tiered: Tier0: Pure security research shops, like Google Project Zero and alike. YOu can only get this job after doing PhD in Computer Security at top-tier university lab, and have publications on stuff like linux kernel fuzzing, have 10+ linux CVEs under your belt, and listed as contributor to a well-known open-source security tool. Tier1: top security vendors: crowdstrike zs qualys pan cisco and etc. R&D (or Business Unit) departments responsible for developing security product features and maintaining security content. Tier2: FAANG and adjacent cloud-native companies, job title "security software engineer" or "security engineer" or "$platform_name engineer" or "cloudsec/appsec engineer" Tier3: pre-IPO unicorns which are hiring for Product Security and AppSecurity positions ... Tier10+: all other public companies, regular S&P500 infosec department. the general rule is the higher the salary the more demanding the job will be and the tougher is competition to get that job
- kstrauser 3y ago
  > I am gonna surprise you, but nobody from cybersecurity is finding vulnerabilities either. My recent interview as a security engineer had distinct sections for software review and for architecture analysis. My last job had me running Burp Suite once a month (because it was fun and I didn't mind doing it), but that was roughly 30 minutes every 4 weeks. Sounds like you've worked with some quite junior security teams.
  - slt2021 3y ago
    interview vs real work is different. FAANG engineers are not flipping a binary tree either, yet this is a common question they ask. as for Burp Suite - why would a company keep engineer full-time only for him to run burp suite for 30 minutes once a month? Sounds like poor investment on a company's side.
    - kstrauser 3y ago
      > interview vs real work is different. ...or, and hear me out, maybe some companies are more proactive about their security. Craziness, I know, but maybe! > why would a company keep engineer full-time only for him to run burp suite for 30 minutes once a month? Uh, I was doing other things the other 159.5 hours a month.
      - slt2021 3y ago
        so you agree that it is cheaper and better to ask SRE team to run BurpSuite for 30 minutes once a week, rather than hiring FTE to do that?
        kstrauser 3y ago
        I honestly have no idea what you're trying to say.
- pizzalife 3y ago
  >I am gonna surprise you, but nobody from cybersecurity is finding vulnerabilities either. Well, no. I work in "cybersecurity" and my day job is literally finding vulnerabilities.

HotPotato787 3y ago

> If you have a competent and fully staffed SRE Platform engineering team - you will NOT need a separate cybersecurity team. Not all cybersecurity problems are platform problems, or even technical problems. Even if you decide to gather all AppSec/InfraSec engineers inside of SRE/SysAdmin, this creates two problems: 1 - They are now separate from the main cybersecurity team, which is solving other problems and that in turn creates all sorts of issues ranging from lack of coordination to managerial ones. 2 - This creates a HUGE lack of separation of duties (or a conflict of interest). The executor of a task should never be the auditor of a task. You cannot expect the SRE team to go out of their way to keep finding flaws in their own work and exposing them to the board so they can be forced to reprioritize and fix these flaws. The SRE can and should have security built-in as much as possible, but an external team is still required.

slt2021 3y ago
SRE is really a more familiar "sysadmin" from good ole days. You know, that bearded IT guru in a basement floor, will curse and shout at you, but will keep your company running when it comes to IT. if you switch back to sysadmin model - having a single sysadmin do all the SRE and security work, divided per platform, then separate security is indeed feel like extra. You can obviously hire independent third party security auditors and do pentest, but that thing could be done once a year. Often times your financial auditors (Big 4 accounting firms) will offer IT audit and pentest in a bundle and you can get a good deal.