5 ms·

All Those Companies that Can't Afford Dedicated Security

60 points by 127001brewer 14y ago

tptacek 14y ago
After "what's the best new way I can find people who can write code fast and who will have a talent for finding security vulnerabilities", this is the issue that occupies all my cycles. Like most firms working in security, our bread is buttered by large companies, who are bidding very high numbers for (in our case) appsec testing. But by number, a conspicuously large fraction of our customers are mid-late stage startups, and taken as a whole, we talk to more startups than any other kind of business. Startups are particularly exposed to the security market problem. They have very little infrastructure and they are spending most of their cycles just trying to stay in business and find traction. At the same time, they've managed to outsource all of the technical requirements of their businesses except the part which bears the highest security risk, which is their custom code. What can we do about this? I talk to YC companies all the time, and it's frustrating. I am always good for a phone call and we'll even poke at startup apps pro-bono (we love working with startups) but that help has to get in line behind our paying clients, all of whom can be counted on to appear from behind a dark corner at any moment and swallow 2-3 weeks of our time whole. I am seriously all ears for ideas on how security people like iSEC and Matasano can help early-stage startups without invoicing half+ of those startups last funding round.
- 127001brewer 14y ago
  ... we'll even poke at startup apps pro-bono ... Is this any start-up or just the YC companies?
  - tptacek 14y ago
    If you have questions I can help with, it can't hurt to mail them; the worst that can happen is I'm too busy to respond quickly. I don't have a YC filter or anything.
- lifeisstillgood 14y ago
  I have always assumed this is about the editing of choices - there is a vast world of OSS choices. And I cannot keep up. I would happily buy Matasano-branded cloud servers that talked the AWS/OpenStack API (ie were actually run there) but were imaged off one baseline that was Thomas-Approved. I dont trust other people's Chef or Puppet recipies to install nginx for me. I would trust yours. That means I would start writing my application on your branded stack. If that means I get to only use vi on OpenBSD then - hey there is real badge value in it still:-) And if actually I can only deploy my code to your secure server via a CI process, all the better. After that we can talk appsec, and scaling.
  - danielweber 14y ago
    There was a guy in the Pinboard Prosperity Cloud who was working on best-in-class secure VMs. I haven't seen a follow-up but it's only been several weeks. http://static.pinboard.in/prosperity_cloud.htm http://static.pinboard.in/prosperity_cloud.htm
    - lifeisstillgood 14y ago
      Thank you - I write six paragraphs to describe your six words - "best-in-class secure VMs". That's what I meant - what he said.:-)
    - tptacek 14y ago
      Shit I owe that guy $55.
  - jiggy2011 14y ago
    Having a secure baseline setup is obviously important. However the point that tptacek seems to be making is that most of the security risk of startups comes from the custom code that they write. You can have the most hardened openBSD setup in the world but if you write a web app that runs shell commands based on user input and you don't validate well enough you might be in for a bad time.
    - lifeisstillgood 14y ago
- deleted 14y ago
  [deleted]
- rarrrrrr 14y ago
  Obviously you've spent more time considering this, but on the off chance it's helpful: 1. Take payment in some other form. Get creative. 2. Link the infosec to the startup's revenue. In other words, make it something we can sell. Applicable within specific domains. For example, I'd buy a modern CRM solution I had infosec confidence in, but until then we're sticking with our self hosted install of RT. 3. Expand security code review to be a more generalized form of code review that also yields improvements in time to market, overall code quality and project risk. Sell as such. Various research concludes that expert code review early in a project dramatically helps overall productivity. It's easier to test, review, and fix the bugs and awkward sections of code now than maintain it and troubleshoot customers across the following months or years. Whenever I'm doing an internal review even if I'm specifically scanning for vulnerabilities, I can't help but notice any number of garden variety bugs, things needing to be refactored, obvious ways to fill gaps in test coverage, better variable and function names, helpful comments I could add, etc. Maybe this isn't a good use of a high end security researcher's time and could be better left to someone more general, but you could staff some code quality minded generalists. It's quicker to audit clean code so maybe it pays off.
- bradleybuda 14y ago
  There's a flip side to the problem - not only can startups not pay, but they might not even know that they should be talking to someone like Matasano. Many tech startups severely underestimate the security implications of what they're doing, especially those dealing with very private business data or very personal consumer data. With respect to fees, there's a whole swath of lawyers, accountants, and other service providers who work with companies from YC and other incubators. They don't work pro bono - they operate on some combination of fee deferral and / or equity. I realize this still doesn't have as much impact as the checks the big guys write, but it seems like it would close the gap.
- lifeisstillgood 14y ago
  Actually having thought about this, it's commoditising your junior staff. I saw a video of you explaining how to break cookies that have stored password-equivalents in encrypted apps (with iirr fixed block cipher dictionary attack(?)). The throw away comment was although it looked like magic when shown to clients it was simple and appsec researchers had to write their own as a rite of passage. So raise the bar on every appsec company out there by making An app / site / whatever that is really simple to do that attack on ones own site. We all should do nmap to check we have locked out ports down - you want it to be known We should run Thomas-map to check our cookies, etc The specifics are less important than I should be able to read your notes and discover the same vulnerabilities your juniors could on my own app - be aide having found them I probably don't know how to fix them but am damn sure who I will ask.
joonix 14y ago
I'm not in IT nor am I a software engineer. That said I'm tech proficient and was an amateur coder in a past life. Security seems like it has a solid future. What's the best way to train for a career (change) in IT security?
- tptacek 14y ago
  You have successfully slain the red wumpus. His bleeding corpse lies before your feet. Your quest continues; choose your own adventure: * If designing and enforcing rules and policy interests you, turn to page 23. * If deploying and managing complex technical infrastructure interests you, turn to page 12. * If being a part of teams that ship products is what gets you up in the morning, turn to page 45. * If being a part of teams that tear shipping or soon-to-be shipping products to shreds is more your thing, turn to page 34. Which will you choose? I'll tell you what the page says.
  - nicholassmith 14y ago
    If the quest is open to all comers, I turn to page 34.
    - tptacek 14y ago
      Shamelessly self-plagiarized: 0. Learn to love programming in at least one language. The C Programming Language has the most cachet in application security, but for this step-by-step list, Java or Python or Ruby will do fine. 1. Grab a copy of The Web Application Hacker’s Handbook and The Tangled Web 2. Go to the “previous releases” archive at WordPress.org and grab very old versions of WordPress; install them at EC2. 3. Download OWASP WebScarab or Burp Suite Free Edition, both of which are free, and use them to find bugs in ancient WordPress. If you are at step 0 now and are immediately looking for a new gig in Chicago, San Francisco, or New York, you can also email me directly and get step 1 for free.
  - didsomeonesay 14y ago
    Page 31 please :)
mattmanser 14y ago
Today, it's increasingly rare for organizations to have bespoke security, just as it's increasingly rare for them to have bespoke IT. It's only the larger organizations that can afford it. The rest of the article is based off this premise, which I can't agree with at all. It's the micro and small companies that are using off-the-shelf cloud software, not the mid-size companies. I know of two software vendors in my city alone that sell project management software to mid-size companies, both offer bespoke customization on top of a core product (one written in-house, one Dynamics CRM) and they are both doing a roaring trade in completely different markets. All of these off the shelf cloud systems offer only the most basic business functionality when you actually get down to it. Salesforce just manages sales. That's all. To get it to do more you need to do bespoke customisation. And then you find out you can't just pay someone to build some software and let it just run, you need to be able to change it as your market and needs change. EDIT: My impression is that off-the-shelf cloud software is replacing shared excel spreadsheets and Access DBs. But this is all based on gut, I'd be interested to see any evidence supporting either me or Bruce.
stcredzero 14y ago
The big hole here, is that security in this day and age involves preventing phishing attacks. The only way that you can protect users from their own stupidity is to lock them down. Google Chrome and other walled gardens may win, because they come locked down by default. Corollary: Open Source may remain a thing for geeks only because of this.
- snowwrestler 14y ago
  True. To fight phishing without locking down users takes staff and software to scan the network in real time, to catch phishing attacks as they succeed but before they get anything. That stuff is expensive.

60 points by 127001brewer 14y ago

After "what's the best new way I can find people who can write code fast and who will have a talent for finding security vulnerabilities", this is the issue that occupies all my cycles. Like most firms working in security, our bread is buttered by large companies, who are bidding very high numbers for (in our case) appsec testing. But by number, a conspicuously large fraction of our customers are mid-late stage startups, and taken as a whole, we talk to more startups than any other kind of business. Startups are particularly exposed to the security market problem. They have very little infrastructure and they are spending most of their cycles just trying to stay in business and find traction. At the same time, they've managed to outsource all of the technical requirements of their businesses except the part which bears the highest security risk, which is their custom code. What can we do about this? I talk to YC companies all the time, and it's frustrating. I am always good for a phone call and we'll even poke at startup apps pro-bono (we love working with startups) but that help has to get in line behind our paying clients, all of whom can be counted on to appear from behind a dark corner at any moment and swallow 2-3 weeks of our time whole. I am seriously all ears for ideas on how security people like iSEC and Matasano can help early-stage startups without invoicing half+ of those startups last funding round.

127001brewer 14y ago
... we'll even poke at startup apps pro-bono ... Is this any start-up or just the YC companies?
- tptacek 14y ago
  If you have questions I can help with, it can't hurt to mail them; the worst that can happen is I'm too busy to respond quickly. I don't have a YC filter or anything.
lifeisstillgood 14y ago
I have always assumed this is about the editing of choices - there is a vast world of OSS choices. And I cannot keep up. I would happily buy Matasano-branded cloud servers that talked the AWS/OpenStack API (ie were actually run there) but were imaged off one baseline that was Thomas-Approved. I dont trust other people's Chef or Puppet recipies to install nginx for me. I would trust yours. That means I would start writing my application on your branded stack. If that means I get to only use vi on OpenBSD then - hey there is real badge value in it still:-) And if actually I can only deploy my code to your secure server via a CI process, all the better. After that we can talk appsec, and scaling.
- danielweber 14y ago
  There was a guy in the Pinboard Prosperity Cloud who was working on best-in-class secure VMs. I haven't seen a follow-up but it's only been several weeks. http://static.pinboard.in/prosperity_cloud.htm http://static.pinboard.in/prosperity_cloud.htm
  - lifeisstillgood 14y ago
    Thank you - I write six paragraphs to describe your six words - "best-in-class secure VMs". That's what I meant - what he said.:-)
  - tptacek 14y ago
    Shit I owe that guy $55.
- jiggy2011 14y ago
  Having a secure baseline setup is obviously important. However the point that tptacek seems to be making is that most of the security risk of startups comes from the custom code that they write. You can have the most hardened openBSD setup in the world but if you write a web app that runs shell commands based on user input and you don't validate well enough you might be in for a bad time.
  - lifeisstillgood 14y ago
deleted 14y ago
[deleted]
rarrrrrr 14y ago
Obviously you've spent more time considering this, but on the off chance it's helpful: 1. Take payment in some other form. Get creative. 2. Link the infosec to the startup's revenue. In other words, make it something we can sell. Applicable within specific domains. For example, I'd buy a modern CRM solution I had infosec confidence in, but until then we're sticking with our self hosted install of RT. 3. Expand security code review to be a more generalized form of code review that also yields improvements in time to market, overall code quality and project risk. Sell as such. Various research concludes that expert code review early in a project dramatically helps overall productivity. It's easier to test, review, and fix the bugs and awkward sections of code now than maintain it and troubleshoot customers across the following months or years. Whenever I'm doing an internal review even if I'm specifically scanning for vulnerabilities, I can't help but notice any number of garden variety bugs, things needing to be refactored, obvious ways to fill gaps in test coverage, better variable and function names, helpful comments I could add, etc. Maybe this isn't a good use of a high end security researcher's time and could be better left to someone more general, but you could staff some code quality minded generalists. It's quicker to audit clean code so maybe it pays off.
bradleybuda 14y ago
There's a flip side to the problem - not only can startups not pay, but they might not even know that they should be talking to someone like Matasano. Many tech startups severely underestimate the security implications of what they're doing, especially those dealing with very private business data or very personal consumer data. With respect to fees, there's a whole swath of lawyers, accountants, and other service providers who work with companies from YC and other incubators. They don't work pro bono - they operate on some combination of fee deferral and / or equity. I realize this still doesn't have as much impact as the checks the big guys write, but it seems like it would close the gap.
lifeisstillgood 14y ago
Actually having thought about this, it's commoditising your junior staff. I saw a video of you explaining how to break cookies that have stored password-equivalents in encrypted apps (with iirr fixed block cipher dictionary attack(?)). The throw away comment was although it looked like magic when shown to clients it was simple and appsec researchers had to write their own as a rite of passage. So raise the bar on every appsec company out there by making An app / site / whatever that is really simple to do that attack on ones own site. We all should do nmap to check we have locked out ports down - you want it to be known We should run Thomas-map to check our cookies, etc The specifics are less important than I should be able to read your notes and discover the same vulnerabilities your juniors could on my own app - be aide having found them I probably don't know how to fix them but am damn sure who I will ask.

joonix 14y ago

I'm not in IT nor am I a software engineer. That said I'm tech proficient and was an amateur coder in a past life. Security seems like it has a solid future. What's the best way to train for a career (change) in IT security?

tptacek 14y ago
You have successfully slain the red wumpus. His bleeding corpse lies before your feet. Your quest continues; choose your own adventure: * If designing and enforcing rules and policy interests you, turn to page 23. * If deploying and managing complex technical infrastructure interests you, turn to page 12. * If being a part of teams that ship products is what gets you up in the morning, turn to page 45. * If being a part of teams that tear shipping or soon-to-be shipping products to shreds is more your thing, turn to page 34. Which will you choose? I'll tell you what the page says.
- nicholassmith 14y ago
  If the quest is open to all comers, I turn to page 34.
  - tptacek 14y ago
    Shamelessly self-plagiarized: 0. Learn to love programming in at least one language. The C Programming Language has the most cachet in application security, but for this step-by-step list, Java or Python or Ruby will do fine. 1. Grab a copy of The Web Application Hacker’s Handbook and The Tangled Web 2. Go to the “previous releases” archive at WordPress.org and grab very old versions of WordPress; install them at EC2. 3. Download OWASP WebScarab or Burp Suite Free Edition, both of which are free, and use them to find bugs in ancient WordPress. If you are at step 0 now and are immediately looking for a new gig in Chicago, San Francisco, or New York, you can also email me directly and get step 1 for free.
- didsomeonesay 14y ago
  Page 31 please :)

mattmanser 14y ago

Today, it's increasingly rare for organizations to have bespoke security, just as it's increasingly rare for them to have bespoke IT. It's only the larger organizations that can afford it. The rest of the article is based off this premise, which I can't agree with at all. It's the micro and small companies that are using off-the-shelf cloud software, not the mid-size companies. I know of two software vendors in my city alone that sell project management software to mid-size companies, both offer bespoke customization on top of a core product (one written in-house, one Dynamics CRM) and they are both doing a roaring trade in completely different markets. All of these off the shelf cloud systems offer only the most basic business functionality when you actually get down to it. Salesforce just manages sales. That's all. To get it to do more you need to do bespoke customisation. And then you find out you can't just pay someone to build some software and let it just run, you need to be able to change it as your market and needs change. EDIT: My impression is that off-the-shelf cloud software is replacing shared excel spreadsheets and Access DBs. But this is all based on gut, I'd be interested to see any evidence supporting either me or Bruce.

stcredzero 14y ago

The big hole here, is that security in this day and age involves preventing phishing attacks. The only way that you can protect users from their own stupidity is to lock them down. Google Chrome and other walled gardens may win, because they come locked down by default. Corollary: Open Source may remain a thing for geeks only because of this.

snowwrestler 14y ago
True. To fight phishing without locking down users takes staff and software to scan the network in real time, to catch phishing attacks as they succeed but before they get anything. That stuff is expensive.