3 ms·

The vast majority of the security "industry" is about useless compliance, rather than actual security. The chimps have put their fears into large enterprise com

by danjl 2y ago

The vast majority of the security "industry" is about useless compliance, rather than actual security. The chimps have put their fears into large enterprise compliance documents. This teaches the junior security people at enterprise companies that these useless fears are necessary, and they pass them along to their friends. Why? Not just because of chimps and fear, but also $$. There is a ton of money to be made off of silly chimps.

goalieca 2y ago
I’m an engineer who now works security. Very few of us come from an engineering background. Most lack the technical skill to do much than apply controls and run tooling. Some try to do design work but imagine a junior dev with 2-3 years experience trying to write a service. Those of us who are architects and coders don’t often get to do it anymore because we’re not working on single projects or solutions.. so we become people who swoop in on a project for a month at a time to make sure there’s no major smells before moving on. Our understanding our your system is shallow as a result.
- sebazzz 2y ago
  > I’m an engineer who now works security. Very few of us come from an engineering background. Most lack the technical skill to do much than apply controls and run tooling. I think you probably hit the nail on the head there. Often the people in Infosec I work with are not interested into putting things in context, thinking into the actual impact of a control not being met. Instead, just a bunch of controls are thrown out without any regard to the actual security. Now I have to say, most of our security has been outsourced to cheap workers in developing countries like India, which are of course rated on maintaining the standard and not rated on thinking and understanding what you want, and probably also work 60-70 hours per week during ungodly times so you can hardly blame them.
Spivak 2y ago
Compliance is useful, just not for security. * You get a cool industry certification that you can put on your website to justify the vague "we take your security seriously" platitudes we spew. * It lets you stop putting money and effort into security once you've renewed your certs this year. * You don't need to hire a dedicated security person, any sysadmin can check boxes. * You can say you followed industry best practices and "did all you could" when you get breached. It's the answer to "how do we not care about security?" across an entire industry that stands to make billions from said lack of care. In a depressing way, the company with useless performative security certs will fare better after a breach then the one without them but that actually tried. My less cynical take about this is that if you need to actually care about security because you'll be up against sophisticated targeted attacks then you probably already know that. For everyone else there's checkboxes to stop companies from getting owned by drive-by attacks.
- NoPicklez 2y ago
  Your first sentence isn't necessarily true There is compliance everywhere and compliance is often complying with larger industry "requirements" or considered best practice controls. If you start a business from scratch, I don't know any company that has developed their own controls library from scratch without complying with some sort of framework or baseline controls set. The frameworks and control sets that you often comply exist and are there for a reason, but your mileage may vary if you choose to use them.
NoPicklez 2y ago
Well one of the big problems is that businesses don't do root cause analysis on incidents and learn what controls failed, or should have been in place that may have prevented the incident. Additionally, actually testing if the controls works. I work in testing controls and I find a lot of controls might be developed well, but just simply aren't being done due to resource constraints.

by danjl 2y ago

goalieca 2y ago

I’m an engineer who now works security. Very few of us come from an engineering background. Most lack the technical skill to do much than apply controls and run tooling. Some try to do design work but imagine a junior dev with 2-3 years experience trying to write a service. Those of us who are architects and coders don’t often get to do it anymore because we’re not working on single projects or solutions.. so we become people who swoop in on a project for a month at a time to make sure there’s no major smells before moving on. Our understanding our your system is shallow as a result.

sebazzz 2y ago
> I’m an engineer who now works security. Very few of us come from an engineering background. Most lack the technical skill to do much than apply controls and run tooling. I think you probably hit the nail on the head there. Often the people in Infosec I work with are not interested into putting things in context, thinking into the actual impact of a control not being met. Instead, just a bunch of controls are thrown out without any regard to the actual security. Now I have to say, most of our security has been outsourced to cheap workers in developing countries like India, which are of course rated on maintaining the standard and not rated on thinking and understanding what you want, and probably also work 60-70 hours per week during ungodly times so you can hardly blame them.

Spivak 2y ago

Compliance is useful, just not for security. * You get a cool industry certification that you can put on your website to justify the vague "we take your security seriously" platitudes we spew. * It lets you stop putting money and effort into security once you've renewed your certs this year. * You don't need to hire a dedicated security person, any sysadmin can check boxes. * You can say you followed industry best practices and "did all you could" when you get breached. It's the answer to "how do we not care about security?" across an entire industry that stands to make billions from said lack of care. In a depressing way, the company with useless performative security certs will fare better after a breach then the one without them but that actually tried. My less cynical take about this is that if you need to actually care about security because you'll be up against sophisticated targeted attacks then you probably already know that. For everyone else there's checkboxes to stop companies from getting owned by drive-by attacks.

NoPicklez 2y ago
Your first sentence isn't necessarily true There is compliance everywhere and compliance is often complying with larger industry "requirements" or considered best practice controls. If you start a business from scratch, I don't know any company that has developed their own controls library from scratch without complying with some sort of framework or baseline controls set. The frameworks and control sets that you often comply exist and are there for a reason, but your mileage may vary if you choose to use them.

NoPicklez 2y ago

Well one of the big problems is that businesses don't do root cause analysis on incidents and learn what controls failed, or should have been in place that may have prevented the incident. Additionally, actually testing if the controls works. I work in testing controls and I find a lot of controls might be developed well, but just simply aren't being done due to resource constraints.