3 ms·

> ... techniques shrouded in mystery clearly have value to the purveyor of investment advice. After all, what witch doctor has ever achieved fame and fortune by

> ... techniques shrouded in mystery clearly have value to the purveyor of investment advice. After all, what witch doctor has ever achieved fame and fortune by simply advising “Take two aspirins”? Off topic, but Buffett could also have been writing about the computer security industry here. "Minimise your attack surface, implement good password policies, patch often and practice defence in depth? Sounds boring, let's buy this AI-enhanced threat intel product, it found the North Koreans!"

xorcist 3y ago
That bothers me every time there was an incident and someone explains that "this organization has under-invested in cybersecurity". From my perspective, it is just as likely that overinvesting in cybersecurity is problematic. Nobody is more secure for buying more products, especially if the existing products are underutilized or undermaintained. Not even the talking heads or our industry pretends to be interested in minimizing attack surface anymore. We're just supposed to buy "more security".
- sokoloff 3y ago
  It may be just as likely to be problematic, given that it’s done, but I think it’s far less commonly done. Invest 100% into product and 0% into security: you get a product and have a chance to build something that fits a valuable market. Invest 0% into product and 100% into security: you get no product and have no chance to find a valuable market. It’s no surprise that most founders (and most established companies) are biased away from significant over-investments in security.
- klabb3 3y ago
  > From my perspective, it is just as likely that overinvesting in cybersecurity is problematic. Nobody is more secure for buying more products Yes, but isn’t this because security cannot generally be packaged into a product? Just like how anti-virus programs was a bad solution for consumers, a lot of the same snake oil is packaged up with B2B stickers and bolted-on a disastrous core of insecure dev and ops practices? I mean the companies with a good security track record that I know of develops it all in-house, and it permeates the culture of those companies, from the first design ideas through development, maintenance and ops.
- Terr_ 3y ago
  I've observed some companies investing money into software to be the "bad cop" against certain employee behavior instead of pulling other political-capital levers to alter incentive-plans or evaluation criteria. (In particular, the problem of salespeople going for low-margin or hard-to-execute deals because they're motivated by the commission.) In other words, companies may choose to over-spend money in "security products" while simultaneously under-spending in managerial effort to change incentives or culture.

xorcist 3y ago

That bothers me every time there was an incident and someone explains that "this organization has under-invested in cybersecurity". From my perspective, it is just as likely that overinvesting in cybersecurity is problematic. Nobody is more secure for buying more products, especially if the existing products are underutilized or undermaintained. Not even the talking heads or our industry pretends to be interested in minimizing attack surface anymore. We're just supposed to buy "more security".

sokoloff 3y ago
It may be just as likely to be problematic, given that it’s done, but I think it’s far less commonly done. Invest 100% into product and 0% into security: you get a product and have a chance to build something that fits a valuable market. Invest 0% into product and 100% into security: you get no product and have no chance to find a valuable market. It’s no surprise that most founders (and most established companies) are biased away from significant over-investments in security.
klabb3 3y ago
> From my perspective, it is just as likely that overinvesting in cybersecurity is problematic. Nobody is more secure for buying more products Yes, but isn’t this because security cannot generally be packaged into a product? Just like how anti-virus programs was a bad solution for consumers, a lot of the same snake oil is packaged up with B2B stickers and bolted-on a disastrous core of insecure dev and ops practices? I mean the companies with a good security track record that I know of develops it all in-house, and it permeates the culture of those companies, from the first design ideas through development, maintenance and ops.
Terr_ 3y ago
I've observed some companies investing money into software to be the "bad cop" against certain employee behavior instead of pulling other political-capital levers to alter incentive-plans or evaluation criteria. (In particular, the problem of salespeople going for low-margin or hard-to-execute deals because they're motivated by the commission.) In other words, companies may choose to over-spend money in "security products" while simultaneously under-spending in managerial effort to change incentives or culture.