4 ms·

China's Volt Typhoon hackers target US infrastructure

14 points by jseliger 3y ago

kortilla 3y ago
What is the cybersecurity equivalent in the US of something like Anduril? Most cybersecurity companies seem like sleazy crapware sellers for corporations to check compliance boxes. Which companies are actually building good defensive cybersecurity on the sole bet that people will come to it on pure technical merit?
- Veserv 3y ago
  Just ask the penetration testers and offensive researchers if there is any company they and everybody they know can not breach. Anybody who can not protect against even commercial attacks like that is hopeless against state actors. You are correct that you will find all the standard cybersecurity companies in that hopeless pile. As for how you can evaluate on your own, look for positive evidence of security, not the absence of negative evidence. The standard belief is that everything is easy to hack, just ask literally any programmer, any claim of security is a extraordinary claim. It is a mystery why everybody then gets amnesia when a company claims to protect you and not only fails to present extraordinary evidence for such a extraordinary claim, but no evidence at all beyond marketing fluff. Demand positive evidence of protection from state, or at the very least moderately funded commercial, attackers. Serious penetration tests by teams of professionals with months to work on it that consistently fail to find any entry. That is a good starting point. Any proof less than that fails to even meet the standards of ordinary evidence, let alone extraordinary. If you want to go further you can look for design audits, formal specifications, and formal proofs as demanded by certification standards like the SKPP. In contrast, certainly ignore any certification or certification level that consistently certifies known garbage like the aforementioned cybersecurity companies. A bar that consistently passes garbage is not a certification worth a damn. Anybody presenting a option that does not meet those requirements should be soundly ignored until evidence is provided. And yes, that applies even if nobody reaches the minimum bar. You do not claim somebody has cured cancer just because they are the best so far. You do it when they cure cancer.

14 points by jseliger 3y ago

What is the cybersecurity equivalent in the US of something like Anduril? Most cybersecurity companies seem like sleazy crapware sellers for corporations to check compliance boxes. Which companies are actually building good defensive cybersecurity on the sole bet that people will come to it on pure technical merit?

Veserv 3y ago
Just ask the penetration testers and offensive researchers if there is any company they and everybody they know can not breach. Anybody who can not protect against even commercial attacks like that is hopeless against state actors. You are correct that you will find all the standard cybersecurity companies in that hopeless pile. As for how you can evaluate on your own, look for positive evidence of security, not the absence of negative evidence. The standard belief is that everything is easy to hack, just ask literally any programmer, any claim of security is a extraordinary claim. It is a mystery why everybody then gets amnesia when a company claims to protect you and not only fails to present extraordinary evidence for such a extraordinary claim, but no evidence at all beyond marketing fluff. Demand positive evidence of protection from state, or at the very least moderately funded commercial, attackers. Serious penetration tests by teams of professionals with months to work on it that consistently fail to find any entry. That is a good starting point. Any proof less than that fails to even meet the standards of ordinary evidence, let alone extraordinary. If you want to go further you can look for design audits, formal specifications, and formal proofs as demanded by certification standards like the SKPP. In contrast, certainly ignore any certification or certification level that consistently certifies known garbage like the aforementioned cybersecurity companies. A bar that consistently passes garbage is not a certification worth a damn. Anybody presenting a option that does not meet those requirements should be soundly ignored until evidence is provided. And yes, that applies even if nobody reaches the minimum bar. You do not claim somebody has cured cancer just because they are the best so far. You do it when they cure cancer.