3 ms·

Do you work in SecOps? Do you manage the security of thousands and thousands of end user devices with actual users? If so you should be grateful for ways to ha

Do you work in SecOps? Do you manage the security of thousands and thousands of end user devices with actual users? If so you should be grateful for ways to have actual visibility (and possibly blocking) of dangerous activity on the machine. Before EDRs we were blind. EDRs could be better, cheaper, more integrated (that part is not too bad) but saying that PCI-DSS is the only reason for them is disinformation (or lack of actual experience with SecOps)

rho138 2y ago
You’re not going to get through the pitckfork mobs, silent reservation is the only winning move for us while the masses use this as a moment to point and say “see, finally, I told you _this_ would happen.”
- BrandoElFollito 2y ago
  I know, but this is infuriating. I am the first to point to dumb decisions, usually Gartner-based, to buy the "top right quadrant" software when much better is available. However, using them would require knowledge and understanding of your needs and not being backed by an army of consultants. And then there is the useful software to buy. A good EDR is one of them. You have nothing on the open-source market (which I use a lot, supporting the developers through whatever they put in place) and CS is very good. They fucked up great this time but it is fortunately a reversible fuck-up. Not the one where you need to reinstall or you lost data (the latter is less certain, but at least for end users this is not the case). People who are bigots of one of the extremes ("open source is not professional software" or "commercial software is a scam") do not work in other's worlds. I can be proud of my home lab (I am) but it will not scale to the 500,000 devices I deal with at work. I know that what I am doing makes sense on my laptop, but this is far, far from being the case with the 60,000 users who do stupid things. One day in the world of the "enemy" would change a lot of minds.
kragen 2y ago
i can't believe i'm writing a reply to a guy whose name is broken spanish for 'brando, the little fuck'. (literally. there isn't an alternative interpretation.) brando, you've got a lot of nerve touting the superiority of secops and edrs on the day when they caused the worst it outage in history, temporarily crippling the global economy in a way worse than any infosec attack secops has ever stopped centralizing the security of thousands and thousands of end-user devices in the hands of a small team is a recipe for disaster, even if it didn't come with continuous exfiltration of sensitive data from those devices, and that disaster has finally struck. you, by which i mean secops, have done more damage yesterday than all the attackers in history, and the nature of the disaster demonstrates that it could have been enormously worse — and will be next time. i don't care what makes your job easier. you shouldn't be doing that job at all. it's a worthless, destructive job that makes everyone less secure this is not monday-morning quarterbacking on my part, either; i happen to have posted this comment 7 days ago (6 days before the disaster) lamenting infosec spending "going to useless or counterproductive measures like crowdstrike" https://news.ycombinator.com/item?id=40951278 https://news.ycombinator.com/item?id=40951278
- BrandoElFollito 2y ago
  > i can't believe i'm writing a reply to a guy whose name is broken spanish for 'brando, the little fuck'. (literally. there isn't an alternative interpretation.) Oh cool, I had no idea. Now to your point: have you ever worked in cybersecurity in large, complex and heterogenous companies? and have an idea about what is required to keep such a company secure within the reality of its business? If yes - congratulations, you should be nominated as CISO of the century. I would seriously like to learn from you. If not - well, I can give you a lot of advice about football (which I do not follow but I am a great consultant) or DIY (which I am bad at but I am ready to build an electrical and plumbing installation because I saw that in Youtube and, frankly, it looks easy). We can troll our way indefinitely - but I have a lot of work related to this CS disaster. I am super glad for CS, though, for the time and stress it saved me in the past.

rho138 2y ago

You’re not going to get through the pitckfork mobs, silent reservation is the only winning move for us while the masses use this as a moment to point and say “see, finally, I told you _this_ would happen.”

BrandoElFollito 2y ago
I know, but this is infuriating. I am the first to point to dumb decisions, usually Gartner-based, to buy the "top right quadrant" software when much better is available. However, using them would require knowledge and understanding of your needs and not being backed by an army of consultants. And then there is the useful software to buy. A good EDR is one of them. You have nothing on the open-source market (which I use a lot, supporting the developers through whatever they put in place) and CS is very good. They fucked up great this time but it is fortunately a reversible fuck-up. Not the one where you need to reinstall or you lost data (the latter is less certain, but at least for end users this is not the case). People who are bigots of one of the extremes ("open source is not professional software" or "commercial software is a scam") do not work in other's worlds. I can be proud of my home lab (I am) but it will not scale to the 500,000 devices I deal with at work. I know that what I am doing makes sense on my laptop, but this is far, far from being the case with the 60,000 users who do stupid things. One day in the world of the "enemy" would change a lot of minds.

kragen 2y ago

i can't believe i'm writing a reply to a guy whose name is broken spanish for 'brando, the little fuck'. (literally. there isn't an alternative interpretation.) brando, you've got a lot of nerve touting the superiority of secops and edrs on the day when they caused the worst it outage in history, temporarily crippling the global economy in a way worse than any infosec attack secops has ever stopped centralizing the security of thousands and thousands of end-user devices in the hands of a small team is a recipe for disaster, even if it didn't come with continuous exfiltration of sensitive data from those devices, and that disaster has finally struck. you, by which i mean secops, have done more damage yesterday than all the attackers in history, and the nature of the disaster demonstrates that it could have been enormously worse — and will be next time. i don't care what makes your job easier. you shouldn't be doing that job at all. it's a worthless, destructive job that makes everyone less secure this is not monday-morning quarterbacking on my part, either; i happen to have posted this comment 7 days ago (6 days before the disaster) lamenting infosec spending "going to useless or counterproductive measures like crowdstrike" https://news.ycombinator.com/item?id=40951278 https://news.ycombinator.com/item?id=40951278

BrandoElFollito 2y ago
> i can't believe i'm writing a reply to a guy whose name is broken spanish for 'brando, the little fuck'. (literally. there isn't an alternative interpretation.) Oh cool, I had no idea. Now to your point: have you ever worked in cybersecurity in large, complex and heterogenous companies? and have an idea about what is required to keep such a company secure within the reality of its business? If yes - congratulations, you should be nominated as CISO of the century. I would seriously like to learn from you. If not - well, I can give you a lot of advice about football (which I do not follow but I am a great consultant) or DIY (which I am bad at but I am ready to build an electrical and plumbing installation because I saw that in Youtube and, frankly, it looks easy). We can troll our way indefinitely - but I have a lot of work related to this CS disaster. I am super glad for CS, though, for the time and stress it saved me in the past.