3 ms·

Whoa. I briefly worked for a "cyber security" company and couldn't quite put my dinner on why I ultimately hated the product and felt that the approach that th

Whoa. I briefly worked for a "cyber security" company and couldn't quite put my dinner on why I ultimately hated the product and felt that the approach that they took -- and a large part of the industry -- was ultimately a sham. I couldn't quite put it into words, but now I get it: we were building the tools to support the most useless of cybersecurity practices -- org-level checklists.

xyzzy123 2y ago
If you can't do checklists though, you can't do anything else. All activities have lists and recurring calendar entries at their heart. You have to regularly show up and do the things. I agree that deeper / better approaches are required during the "do the things" steps.
- deleted 2y ago
  [deleted]
- yodelshady 2y ago
  Right, I think the industry is too self-critical at times. I onboarded a new client recently, and within five minutes of guessing a Wi-Fi password I had sensitive financial data using stock tools. Anyone with physical access to the office could do the same. Contrast an existing client, after a month of trying and writing custom shellcode loaders, spear phishing campaigns, my entire team had... some graduate CVs. Really, you're saying that because the NSA could probably do a better job with the latter than us by intercepting and hardware-hacking networking gear, that no value has been provided?
cedws 2y ago
That’s basically the entire cybersecurity industry. Companies buy these tools as a kind of blast door for when things go wrong, to point a finger at. “We followed all the checklists and our security software didn’t catch it, it’s not our fault.” If companies cared about security they would hire red teams instead of paying for useless scanners with a <1% signal to noise ratio.
- Frost1x 2y ago
  That’s not just cyber security, that’s part of the reason many service/support contracts tend to exist, the whole CYA finger pointing by externalizing the responsibility. Ultimately you end up having to clean up the mess after either way but at least there’s a paper trail of responsibility passing to CYA.
paulmooreparks 2y ago
Perhaps it depends upon why the checklists exist, how accurately they model what needs to be done, and how closely they are followed. Consider aviation: pilots live by checklists. In the world of aviation, following checklists doesn't guarantee that things won't go wrong during a flight, but not following them or treating them cavalierly is an invitation for disaster. Those checklists are built upon years and years of hard-earned experience. Granted, however, having a checklist for no good reason other than to say that you have a checklist, or not regularly reviewing and updating the checklist based upon real-world conditions, is meaningless.
blencdr 2y ago
I'll be more nuanced.Doing operational security can enhance your security posture, but the real trick in cybersecurity isn’t just putting measures in place, it’s keeping them up over time. That’s where checklists come in. A lot of companies get it wrong. They think the checklist is the security. But really, the checklist is just there to remind you that you did something right before and you need to keep it up. Treating the checklist like it’s the goal is where things go off track.
deleted 2y ago
[deleted]

xyzzy123 2y ago

If you can't do checklists though, you can't do anything else. All activities have lists and recurring calendar entries at their heart. You have to regularly show up and do the things. I agree that deeper / better approaches are required during the "do the things" steps.

deleted 2y ago
[deleted]
yodelshady 2y ago
Right, I think the industry is too self-critical at times. I onboarded a new client recently, and within five minutes of guessing a Wi-Fi password I had sensitive financial data using stock tools. Anyone with physical access to the office could do the same. Contrast an existing client, after a month of trying and writing custom shellcode loaders, spear phishing campaigns, my entire team had... some graduate CVs. Really, you're saying that because the NSA could probably do a better job with the latter than us by intercepting and hardware-hacking networking gear, that no value has been provided?

cedws 2y ago

That’s basically the entire cybersecurity industry. Companies buy these tools as a kind of blast door for when things go wrong, to point a finger at. “We followed all the checklists and our security software didn’t catch it, it’s not our fault.” If companies cared about security they would hire red teams instead of paying for useless scanners with a <1% signal to noise ratio.

Frost1x 2y ago
That’s not just cyber security, that’s part of the reason many service/support contracts tend to exist, the whole CYA finger pointing by externalizing the responsibility. Ultimately you end up having to clean up the mess after either way but at least there’s a paper trail of responsibility passing to CYA.

paulmooreparks 2y ago

Perhaps it depends upon why the checklists exist, how accurately they model what needs to be done, and how closely they are followed. Consider aviation: pilots live by checklists. In the world of aviation, following checklists doesn't guarantee that things won't go wrong during a flight, but not following them or treating them cavalierly is an invitation for disaster. Those checklists are built upon years and years of hard-earned experience. Granted, however, having a checklist for no good reason other than to say that you have a checklist, or not regularly reviewing and updating the checklist based upon real-world conditions, is meaningless.

blencdr 2y ago

I'll be more nuanced.Doing operational security can enhance your security posture, but the real trick in cybersecurity isn’t just putting measures in place, it’s keeping them up over time. That’s where checklists come in. A lot of companies get it wrong. They think the checklist is the security. But really, the checklist is just there to remind you that you did something right before and you need to keep it up. Treating the checklist like it’s the goal is where things go off track.

deleted 2y ago

[deleted]