5 ms·

The misaligned incentives between security and profit, especially in public companies, is not really a fixable problem without a massive cultural shift. I'm not

The misaligned incentives between security and profit, especially in public companies, is not really a fixable problem without a massive cultural shift. I'm not sure at this point what could even trigger one. I've always dabbled in cybersecurity, taking on the hat in various roles over the years but have refused to go full time into it due to what I have personally seen in the industry - an overwhelming focus on compliance rather than actual good security practices, and the compliance standards are either very lacking or poorly enforced.

graemep 2y ago
This is exactly it. There is no incentive to prioritise security. It is not visible to customers, except in terms of compliance, most likely a check-list approach. I think it needs a massive cultural shift, but from customers. If customers were willing to evaluate security (consumers cannot, but enterprise can) properly, demand binding assurances, and make buying choices accordingly industry would respond. Of course MS is too strongly entrenched in the desktop market for this to be completely effective.
- hulitu 2y ago
  > If customers were willing to evaluate security (consumers cannot, but enterprise can) Where i work, IT is outsourced and decision to buy most of the SW is made by managers who have no idea about computers.
- wyldberry 2y ago
  When I first left offensive security consulting and joined an internal defensive team, a wise ex-agency person said to me "In product development, the first things to often get axed are security, and performance. They are invisible to the user, until they aren't, and rarely do failures in those areas end a company." Granted this was prior to ransomware really blowing up, but even that itself is a different threat model that doesn't mean your product has to be good at security.
- fuzzfactor 2y ago
  The purpose of using Microsoft products in an office environment is so that your office can be run with as much personal computer enhancement as you originally realized when you first effectively replaced the traditional office machines or more-labor-intensive tasks with software-powered substitutes. Which all occurred way before any of the things like "single-sign-on" got popular among those who didn't seem to know any better. The second this appeared it was easily recognized as one of the many consumer/entertainment features that must be disabled across every bit of any serious corporate network. Also best disabled on any home computer before it is allowed to touch the internet. There was no forthcoming mitigation, all Microsoft leadership could do was throw up their hands, after all there were unsurmountable reasons why such a threat could not be overcome. >it required customers to turn off one of Microsoft’s most convenient and popular features: Like any other office no-brainer: >the ability to access nearly every program used at work with a single logon. Duh.
- hi-v-rocknroll 2y ago
  Proactive methodology: seatbelts, reactive methodology: hospitalized with traumatic brain injury. The problem is more reactive environments take a Russian Roulette gamble on potentially unrecoverable catastrophes before taking action. (Proactivity is more expensive than clicking a seatbelt.)
- worik 2y ago
  > If customers were willing to evaluate security Many big, famous firms (especially Microsoft) would not exist
- Aerbil313 2y ago
  It’s a market. There’s no demand for security. How often has the average Joe has one of their online accounts hacked or credit card details stolen in 2024? Obviously the most effective way of incentivizing companies to focus on security is NSA assembling a team to hack important companies, create real harm and accompanying press releases. Ah sorry, I meant Russian hacker news.
Sohcahtoa82 2y ago
> an overwhelming focus on compliance rather than actual good security practices I'm an application security engineer. I find that it depends widely on the company. You're right that compliance is purely just a checklist and does and doesn't actually do much for security. At best, it slows down a determined internal attacker. ie, a developer can't install a back door since code reviews are enforced by SCM before merging is allowed. But all the ISO-27001 and SOC-2 audits in the world won't prevent trivial attacks like SQL injection. So the actual security depends on how much buy-in the AppSec team can get from project management. I've had companies where I point out an obviously exploitable flaw that can easily cause DoS, and with some determination could get RCE, and I get radio silence. Others, I point out a flaw where I say "It's incredibly unlikely to be exploitable, and attempts to exploit would require millions of requests that would raise alarms, but if someone is determined enough..." and project management immediately assigned the ticket and it was fixed within a week. I can tell you one thing that's not doing any favors is overly zealous penetration testers that feel like they need to report SOMETHING so they invent something that's not an issue. For example, in one app I worked on, after logging in, the browser would make an API call to get information about the current user, including it's role. The pentester used Burp Suite to alter the response to the call to change the role to "admin", and sure enough, the web page would show the user role as "admin", and so the pentester reported this as a privilege escalation. They clearly didn't go on to the next step of trying to do something as admin, though, because if they did, they'd see the backend still enforces proper RBAC. Changing that role to "admin" essentially just made all the disabled buttons/functionality in the web app light up, but trying to do anything would throw 403 Forbidden. But I digress... > The misaligned incentives between security and profit, especially in public companies, is not really a fixable problem without a massive cultural shift. The EU seems to have figured it out, but the USA is a hypercapitalist hell-hole. It's such a shame that the population is mostly convinced that any regulation is bad and an attack on freedom. I roll my eyes at the Libertarians that claim that the Free Market(tm) will punish bad actors while the worst actors are rising to the top. Bad acting is profitable.
- hannofcart 2y ago
  > The pentester used Burp Suite... We run an SaaS and we get a ton of these. Most of these are absolutely inane and complete waste of our time having to look through their poorly written email begging for 50/100 USD payouts. We pejoratively refer to them as "Burp Babies", the equivalent of "script kiddies".
1oooqooq 2y ago
it was like that in the 90s too. until people like cult of dead cow started to both sell the solutions and give it the tools to exploit everyone not implementing the solutions. today things like dmca actually protect the malicious incompetent and business which don't take on it are fools.
mihaaly 2y ago
I may be off, but to me as an affected outsider (user) the continuing insistance of using passwords after decades (yes, several decades) of problems and proven vulnerability, then to 'mitigate' with putting second line of 'defense' on the very fragile and non-transparent smarphone infrastructure instead of doing real reforms is a sign of not giving a faint fack.
pimlottc 2y ago
In the profit-center view, everything is either a cost center or a profit center. And it is nearly impossible to get anyone to truly care about a "cost center".
- nicce 2y ago
  What if the company is providing only cybersecurity-related services? Could it be in this case, that everything is on profit side.
  - pimlottc 2y ago
    Sure, but to the client hiring them, it's a cost. We'll take the basic compliance package please, no need for any of the gold tier high security features.
    - JohnMakin 2y ago
      Precisely this
    - dreamcompiler 2y ago
      "...because our executives won't get thrown into prison as long as they check all the compliance boxes. In fact, they won't get thrown into prison even if they don't check the compliance boxes, but that would be a minor nuisance, so we'll take basic compliance."
- anarazel 2y ago
  In my experience, the conflict in many bigger orgs isn't even on the cost vs profit axis, it's on the tangible vs non-tangible axis. It's a lot easier for middle managers to show they did well if they deliver customer impacting features than a nebulous "improved security". This is item true even when higher up management actually wants to invest in security.
hi-v-rocknroll 2y ago
It's common knowledge clipboard audits of the perfunctory type skew towards security theater and are the most likely type to be performed because they're cheap and mostly automateable. OTOH, a few SCAP baselines I've seen contain good shit. Standardization and change control with deep, vigilant internal and external review help because infosec is a cross-cutting concern requiring holistic, defense-in-depth controls, checks, and application. Also, avoid a Tragedy of the Commons scenario originating from an attitude of "it's everyone's responsibility" by having a dedicated security team with the resources, authority, and accountability to pushback against unsafe practices, and monitoring and remediating problems.
jjav 2y ago
> an overwhelming focus on compliance rather than actual good security practices Yes, this is sad and mostly a waste of time. However (and perhaps it is what you meant) this is a direct reaction to the lack of that cultural shift towards caring about security. So security teams are mostly left with two choices. One, argue for building secure products because security matters (and be laughed out of the room). Or two, argue for compliance with what the auditors require and that at least move the needle a tiny bit toward security (sometimes).
_3u10 2y ago
Did you buy the more expensive lock for your house? Are your doors fortified, if they are why isn't the steel an inch thicker? Do you also choose having money over security? Sounds like the government also chose having a more productive work force, etc, over higher costs and lower productivity.
- halfcat 2y ago
  > why isn't the steel an inch thicker? In our analysis we determined that if the steel doors were thicker it would hinder our team of ex-special-forces security guards from operating their bazookas effectively in the event a suspicious person is spotted. Unfortunately it’s all too common that potentially dangerous fugitives on the run are trying to blend in as “mail carriers” and “neighbors on a walk”. Anyway, the auditors relented on the steel door issue, but then hammered us on why we didn’t have any tanks moving in formation in the front yard as a deterrent. In fairness, the FedEx guy made it all the way to our front door in two separate incidents last week. So the auditors have a point.
- JohnMakin 2y ago
  Not sure what point you are trying to make - for one, I don’t keep anything valuable in my house. Two, I have adequate security measures for the threats I am likely to deal with - I have cameras, locks on all windows and doors, and I have alarms. The rough security/compliance world equivalent is a checklist that says “Do you lock your doors every night?” and you say “yea I do” regardless of whether or not you even have a lock or what kind it is, and they say “ok cool.” It’s a false dichotomy that you need to choose between security and productivity.
  - _3u10 2y ago
    It isn’t. If it was a false dichotomy everyone would just work from airgapped systems because there’s no trade off.
roughly 2y ago
I read a quote once that a CISO's job was to do enough public talks that when their company inevitably got popped because nobody values security, they've got their next job lined up already.
manquer 2y ago
There is nothing wrong with processes per se, From civil engineering to automotive to aviation there is a tangible outcome to all the laborious audits and paperwork. These systems are lot safer after regulations were put in place however onerous and ineffective they seem
- halfcat 2y ago
  What would this even look like in software? I always wonder if software is different than physical construction, or if software is just less mature of a discipline. In software, we can’t estimate projects accurately and consistently. We have to build a few to throw away just to get a better (yet still incomplete) picture of the problem we’re trying to solve. Imagine if the people building your house had to build half of it and then start over. Maybe twice. That never happens in physical construction. Maybe something has to be redone because someone made a mistake, but almost never due to not understanding the problem. So what’s different about software?
  - manquer 2y ago
    Correctness checking in software already exists for mission critical applications and is seen in sectors like spacecraft or avionics and to a degree in core finance etc. Development in those fields are lot slower and very conservative and is by no means perfect, it is matter of culture and regulation and what you are ready to spend . Project management challenges should not be conflated with product quality. Take JWST, a notoriously hard project to manage costs or timelines, but their product quality was perfect, if we can launch a telescope like that accurately the first time we can build software well, if we can afford it. > Imagine if the people building your house had to build half of it and then start over. Maybe twice. No need to imagine, I have seen people do that all the time, if you have the money you can afford endless remodeling and some people actually do that. It all comes down to appetite to spend on good quality and culture to do so, in the era of low/no/AI code or off-shoring before that, there is constant downward pressure on costs, quality and security are the trade-offs.
deleted 2y ago
[deleted]
michaelcampbell 2y ago
> The misaligned incentives between security and profit Cynically, there is no incentive for security; there is ONLY profit. Security comes into play only where it can increase profit, it's a second order effect. (Of course, there are legal and regulatory pressures here for it as well.)

graemep 2y ago

This is exactly it. There is no incentive to prioritise security. It is not visible to customers, except in terms of compliance, most likely a check-list approach. I think it needs a massive cultural shift, but from customers. If customers were willing to evaluate security (consumers cannot, but enterprise can) properly, demand binding assurances, and make buying choices accordingly industry would respond. Of course MS is too strongly entrenched in the desktop market for this to be completely effective.

hulitu 2y ago
> If customers were willing to evaluate security (consumers cannot, but enterprise can) Where i work, IT is outsourced and decision to buy most of the SW is made by managers who have no idea about computers.
wyldberry 2y ago
When I first left offensive security consulting and joined an internal defensive team, a wise ex-agency person said to me "In product development, the first things to often get axed are security, and performance. They are invisible to the user, until they aren't, and rarely do failures in those areas end a company." Granted this was prior to ransomware really blowing up, but even that itself is a different threat model that doesn't mean your product has to be good at security.
fuzzfactor 2y ago
The purpose of using Microsoft products in an office environment is so that your office can be run with as much personal computer enhancement as you originally realized when you first effectively replaced the traditional office machines or more-labor-intensive tasks with software-powered substitutes. Which all occurred way before any of the things like "single-sign-on" got popular among those who didn't seem to know any better. The second this appeared it was easily recognized as one of the many consumer/entertainment features that must be disabled across every bit of any serious corporate network. Also best disabled on any home computer before it is allowed to touch the internet. There was no forthcoming mitigation, all Microsoft leadership could do was throw up their hands, after all there were unsurmountable reasons why such a threat could not be overcome. >it required customers to turn off one of Microsoft’s most convenient and popular features: Like any other office no-brainer: >the ability to access nearly every program used at work with a single logon. Duh.
hi-v-rocknroll 2y ago
Proactive methodology: seatbelts, reactive methodology: hospitalized with traumatic brain injury. The problem is more reactive environments take a Russian Roulette gamble on potentially unrecoverable catastrophes before taking action. (Proactivity is more expensive than clicking a seatbelt.)
worik 2y ago
> If customers were willing to evaluate security Many big, famous firms (especially Microsoft) would not exist
Aerbil313 2y ago
It’s a market. There’s no demand for security. How often has the average Joe has one of their online accounts hacked or credit card details stolen in 2024? Obviously the most effective way of incentivizing companies to focus on security is NSA assembling a team to hack important companies, create real harm and accompanying press releases. Ah sorry, I meant Russian hacker news.

Sohcahtoa82 2y ago

> an overwhelming focus on compliance rather than actual good security practices I'm an application security engineer. I find that it depends widely on the company. You're right that compliance is purely just a checklist and does and doesn't actually do much for security. At best, it slows down a determined internal attacker. ie, a developer can't install a back door since code reviews are enforced by SCM before merging is allowed. But all the ISO-27001 and SOC-2 audits in the world won't prevent trivial attacks like SQL injection. So the actual security depends on how much buy-in the AppSec team can get from project management. I've had companies where I point out an obviously exploitable flaw that can easily cause DoS, and with some determination could get RCE, and I get radio silence. Others, I point out a flaw where I say "It's incredibly unlikely to be exploitable, and attempts to exploit would require millions of requests that would raise alarms, but if someone is determined enough..." and project management immediately assigned the ticket and it was fixed within a week. I can tell you one thing that's not doing any favors is overly zealous penetration testers that feel like they need to report SOMETHING so they invent something that's not an issue. For example, in one app I worked on, after logging in, the browser would make an API call to get information about the current user, including it's role. The pentester used Burp Suite to alter the response to the call to change the role to "admin", and sure enough, the web page would show the user role as "admin", and so the pentester reported this as a privilege escalation. They clearly didn't go on to the next step of trying to do something as admin, though, because if they did, they'd see the backend still enforces proper RBAC. Changing that role to "admin" essentially just made all the disabled buttons/functionality in the web app light up, but trying to do anything would throw 403 Forbidden. But I digress... > The misaligned incentives between security and profit, especially in public companies, is not really a fixable problem without a massive cultural shift. The EU seems to have figured it out, but the USA is a hypercapitalist hell-hole. It's such a shame that the population is mostly convinced that any regulation is bad and an attack on freedom. I roll my eyes at the Libertarians that claim that the Free Market(tm) will punish bad actors while the worst actors are rising to the top. Bad acting is profitable.

hannofcart 2y ago
> The pentester used Burp Suite... We run an SaaS and we get a ton of these. Most of these are absolutely inane and complete waste of our time having to look through their poorly written email begging for 50/100 USD payouts. We pejoratively refer to them as "Burp Babies", the equivalent of "script kiddies".

1oooqooq 2y ago

it was like that in the 90s too. until people like cult of dead cow started to both sell the solutions and give it the tools to exploit everyone not implementing the solutions. today things like dmca actually protect the malicious incompetent and business which don't take on it are fools.

mihaaly 2y ago

I may be off, but to me as an affected outsider (user) the continuing insistance of using passwords after decades (yes, several decades) of problems and proven vulnerability, then to 'mitigate' with putting second line of 'defense' on the very fragile and non-transparent smarphone infrastructure instead of doing real reforms is a sign of not giving a faint fack.

pimlottc 2y ago

In the profit-center view, everything is either a cost center or a profit center. And it is nearly impossible to get anyone to truly care about a "cost center".

nicce 2y ago
What if the company is providing only cybersecurity-related services? Could it be in this case, that everything is on profit side.
- pimlottc 2y ago
  Sure, but to the client hiring them, it's a cost. We'll take the basic compliance package please, no need for any of the gold tier high security features.
  - JohnMakin 2y ago
    Precisely this
  - dreamcompiler 2y ago
    "...because our executives won't get thrown into prison as long as they check all the compliance boxes. In fact, they won't get thrown into prison even if they don't check the compliance boxes, but that would be a minor nuisance, so we'll take basic compliance."
anarazel 2y ago
In my experience, the conflict in many bigger orgs isn't even on the cost vs profit axis, it's on the tangible vs non-tangible axis. It's a lot easier for middle managers to show they did well if they deliver customer impacting features than a nebulous "improved security". This is item true even when higher up management actually wants to invest in security.

hi-v-rocknroll 2y ago

It's common knowledge clipboard audits of the perfunctory type skew towards security theater and are the most likely type to be performed because they're cheap and mostly automateable. OTOH, a few SCAP baselines I've seen contain good shit. Standardization and change control with deep, vigilant internal and external review help because infosec is a cross-cutting concern requiring holistic, defense-in-depth controls, checks, and application. Also, avoid a Tragedy of the Commons scenario originating from an attitude of "it's everyone's responsibility" by having a dedicated security team with the resources, authority, and accountability to pushback against unsafe practices, and monitoring and remediating problems.

jjav 2y ago

> an overwhelming focus on compliance rather than actual good security practices Yes, this is sad and mostly a waste of time. However (and perhaps it is what you meant) this is a direct reaction to the lack of that cultural shift towards caring about security. So security teams are mostly left with two choices. One, argue for building secure products because security matters (and be laughed out of the room). Or two, argue for compliance with what the auditors require and that at least move the needle a tiny bit toward security (sometimes).

_3u10 2y ago

Did you buy the more expensive lock for your house? Are your doors fortified, if they are why isn't the steel an inch thicker? Do you also choose having money over security? Sounds like the government also chose having a more productive work force, etc, over higher costs and lower productivity.

halfcat 2y ago
> why isn't the steel an inch thicker? In our analysis we determined that if the steel doors were thicker it would hinder our team of ex-special-forces security guards from operating their bazookas effectively in the event a suspicious person is spotted. Unfortunately it’s all too common that potentially dangerous fugitives on the run are trying to blend in as “mail carriers” and “neighbors on a walk”. Anyway, the auditors relented on the steel door issue, but then hammered us on why we didn’t have any tanks moving in formation in the front yard as a deterrent. In fairness, the FedEx guy made it all the way to our front door in two separate incidents last week. So the auditors have a point.
JohnMakin 2y ago
Not sure what point you are trying to make - for one, I don’t keep anything valuable in my house. Two, I have adequate security measures for the threats I am likely to deal with - I have cameras, locks on all windows and doors, and I have alarms. The rough security/compliance world equivalent is a checklist that says “Do you lock your doors every night?” and you say “yea I do” regardless of whether or not you even have a lock or what kind it is, and they say “ok cool.” It’s a false dichotomy that you need to choose between security and productivity.
- _3u10 2y ago
  It isn’t. If it was a false dichotomy everyone would just work from airgapped systems because there’s no trade off.

roughly 2y ago

I read a quote once that a CISO's job was to do enough public talks that when their company inevitably got popped because nobody values security, they've got their next job lined up already.

manquer 2y ago

There is nothing wrong with processes per se, From civil engineering to automotive to aviation there is a tangible outcome to all the laborious audits and paperwork. These systems are lot safer after regulations were put in place however onerous and ineffective they seem

halfcat 2y ago
What would this even look like in software? I always wonder if software is different than physical construction, or if software is just less mature of a discipline. In software, we can’t estimate projects accurately and consistently. We have to build a few to throw away just to get a better (yet still incomplete) picture of the problem we’re trying to solve. Imagine if the people building your house had to build half of it and then start over. Maybe twice. That never happens in physical construction. Maybe something has to be redone because someone made a mistake, but almost never due to not understanding the problem. So what’s different about software?
- manquer 2y ago
  Correctness checking in software already exists for mission critical applications and is seen in sectors like spacecraft or avionics and to a degree in core finance etc. Development in those fields are lot slower and very conservative and is by no means perfect, it is matter of culture and regulation and what you are ready to spend . Project management challenges should not be conflated with product quality. Take JWST, a notoriously hard project to manage costs or timelines, but their product quality was perfect, if we can launch a telescope like that accurately the first time we can build software well, if we can afford it. > Imagine if the people building your house had to build half of it and then start over. Maybe twice. No need to imagine, I have seen people do that all the time, if you have the money you can afford endless remodeling and some people actually do that. It all comes down to appetite to spend on good quality and culture to do so, in the era of low/no/AI code or off-shoring before that, there is constant downward pressure on costs, quality and security are the trade-offs.

deleted 2y ago

[deleted]

michaelcampbell 2y ago

> The misaligned incentives between security and profit Cynically, there is no incentive for security; there is ONLY profit. Security comes into play only where it can increase profit, it's a second order effect. (Of course, there are legal and regulatory pressures here for it as well.)