4 ms·

> Companies that use it don't understand security What should these companies understand about security exactly? And aren’t they kinda right to not trust thei

by WA 2y ago

> Companies that use it don't understand security What should these companies understand about security exactly? And aren’t they kinda right to not trust their employees if they employ 50,000 people with different skills and intentions?

Voultapher 2y ago
Security is a process not a product. Anyone selling you security as a product is scamming you. These endpoint security companies latch onto people making decisions, those people want security and these software vendors promise to make the process as easy as possible. No need to change the way a company operates, just buy our stuff and you're good. That's the scam.
- imiric 2y ago
  Exactly, well said. Truthfully, it must be practically infeasible to transform security practices of a large company overnight. Most of the time they buy into these products because they're chasing a security certification (ISO 27001, SOC2, etc.), and by just deploying this to their entire fleet they get to sidestep the actually difficult part. The irony is that at the end of this they're not anymore "secure" than they were before, but since they have the certification, their customers trust that they are. It's security theater 101.
InsideOutSanta 2y ago
"And aren’t they kinda right to not trust their employees if they employ 50,000 people with different skills and intentions?" Yes, in a 50k employee company, the CEO won't know every single employee and be able to vouch for their skills and intentions. But in a non-dysfunctional company, you have a hierarchy of trust, where each management level knows and trusts the people above and below them. You also have siloed data, where people have access to the specific things they need to do their jobs. And you have disaster mitigation mechanisms for when things go wrong. Having worked in companies of different sizes and with different trust cultures, I do think that problems start to arise when you add things like individual monitoring and control. You're basically telling people that you don't trust them, which makes them see their employer in an adversarial role, which actually makes them start to behave less trustworthy, which further diminishes trust across the company, harms collaboration, and eventually harms productivity and security.
- snotrockets 2y ago
  That’s a lie we tell children so they think the world is fair. A Marxist reading would suggest alienation, but a more modern one would realize that it is a bit more than that: to enable modern business practices (both good and bad!) we designed systems of management to remove or reduce trust and accountability in the org, yet maintain as similar results to a world that is more in line with the one you believe is possible. A security professional though would tell you that even in such a world, you can not expect even the most diligent folks to be able to identify all risks (e.g. phishing became so good, even professionals can’t always discern the real from fake), or practice perfect opsec (which probably requires one to be a psychopath).
- protomolecule 2y ago
  "But in a non-dysfunctional company, you have a hierarchy of trust, where each management level knows and trusts the people above and below them. " Even in a company of two sometimes a husband or a wife betrays the trust. Now multiply that probability by 50000.
  - TeMPOraL 2y ago
    Yet we don't apply total surveillance to people. The reason isn't just ethics and US constitution, but also that it's just not possible without destroying society. Same perhaps applies to computer systems.
    - protomolecule 2y ago
      Which is a completely different argument
      - TeMPOraL 2y ago
        I think it doesn't. I think that the kind of security the likes of CrowdStrike promise is fundamentally impossible to have, and pursuing it is a fool's errand.
- kemotep 2y ago

by WA 2y ago

Voultapher 2y ago

Security is a process not a product. Anyone selling you security as a product is scamming you. These endpoint security companies latch onto people making decisions, those people want security and these software vendors promise to make the process as easy as possible. No need to change the way a company operates, just buy our stuff and you're good. That's the scam.

imiric 2y ago
Exactly, well said. Truthfully, it must be practically infeasible to transform security practices of a large company overnight. Most of the time they buy into these products because they're chasing a security certification (ISO 27001, SOC2, etc.), and by just deploying this to their entire fleet they get to sidestep the actually difficult part. The irony is that at the end of this they're not anymore "secure" than they were before, but since they have the certification, their customers trust that they are. It's security theater 101.

InsideOutSanta 2y ago

"And aren’t they kinda right to not trust their employees if they employ 50,000 people with different skills and intentions?" Yes, in a 50k employee company, the CEO won't know every single employee and be able to vouch for their skills and intentions. But in a non-dysfunctional company, you have a hierarchy of trust, where each management level knows and trusts the people above and below them. You also have siloed data, where people have access to the specific things they need to do their jobs. And you have disaster mitigation mechanisms for when things go wrong. Having worked in companies of different sizes and with different trust cultures, I do think that problems start to arise when you add things like individual monitoring and control. You're basically telling people that you don't trust them, which makes them see their employer in an adversarial role, which actually makes them start to behave less trustworthy, which further diminishes trust across the company, harms collaboration, and eventually harms productivity and security.

snotrockets 2y ago
That’s a lie we tell children so they think the world is fair. A Marxist reading would suggest alienation, but a more modern one would realize that it is a bit more than that: to enable modern business practices (both good and bad!) we designed systems of management to remove or reduce trust and accountability in the org, yet maintain as similar results to a world that is more in line with the one you believe is possible. A security professional though would tell you that even in such a world, you can not expect even the most diligent folks to be able to identify all risks (e.g. phishing became so good, even professionals can’t always discern the real from fake), or practice perfect opsec (which probably requires one to be a psychopath).
protomolecule 2y ago
"But in a non-dysfunctional company, you have a hierarchy of trust, where each management level knows and trusts the people above and below them. " Even in a company of two sometimes a husband or a wife betrays the trust. Now multiply that probability by 50000.
- TeMPOraL 2y ago
  Yet we don't apply total surveillance to people. The reason isn't just ethics and US constitution, but also that it's just not possible without destroying society. Same perhaps applies to computer systems.
  - protomolecule 2y ago
    Which is a completely different argument
    - TeMPOraL 2y ago
      I think it doesn't. I think that the kind of security the likes of CrowdStrike promise is fundamentally impossible to have, and pursuing it is a fool's errand.
kemotep 2y ago