Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why there are so many cybersecurity vendors and where do we go from here

ventureinsecurity.net

Post reply on HN
Print view View original

1–10 of 61 posts

Re: Why there are so many cybersecurity vendors and where do we go from here

#3

Post by sylens »

There is also another issue with cybersecurity vendors that this article doesn't touch on, and that's in the area of cloud security where many of them started targeting a specific use case or set of use cases, and have slowly expanded to overlap with other vendors who were not previously competitors. It's not good enough for a tool to just be used for Cloud Security Posture Management (CSPM) - it also has to do CI/CD security stuff and workload protection. And it happens from the other direction, too - previous image scanning and DevOps-y tools are now adding detection and alerting capabilities for your cloud provider's control plane.

There is going to be a lot of tool consolidation at most organizations coming in the next few years.

Re: Why there are so many cybersecurity vendors and where do we go from here

#5

Post by candiddevmike »

I'm curious on what keeps the prices for these products so high. You'd think with the kind of competition this industry has (all providing the same type of functionality, kinda), you'd see more of a race to the bottom. But when you go to quote, you start seeing a really bizarre pattern where it's almost the same price per feature across the board. I'm not saying it's price fixing, but something's not right here.

Re: Why there are so many cybersecurity vendors and where do we go from here

#6

Post by sylens »

a2tech wrote: post #2

It's a gross industry designed to milk big dollars out of clueless customers. Listening to these 'security experts' talk makes me roll my eyes roll so hard that I'm afraid they'll get stuck in the back of my head.

Most times, you would get ten times the value by taking the money you would spend on these tools, hiring a security engineering department, and letting them build you tools backed by open source software.

Re: Why there are so many cybersecurity vendors and where do we go from here

#7

Post by Canada »

candiddevmike wrote: post #5

I'm curious on what keeps the prices for these products so high. You'd think with the kind of competition this industry has (all providing the same type of functionality, kinda), you'd see more of a race to the bottom. But when you go to quote, you start seeing a really bizarre pattern where it's almost the same price per feature across the board. I'm not saying it's price fixing, but something's not right here.

fear

Re: Why there are so many cybersecurity vendors and where do we go from here

#9

Post by mikewarot »

>Where do we go from here?

Take a step back, and look at history. It should be unsurprising that the problem was encountered, studied[0] and solved, decades ago.

During the Viet Nam conflict, the Air Force needed to plan missions with multiple levels of classified data. This couldn't be done with the systems of that era. This resulted in research and development of multi-level security, the Bell-LaPadula model[2], and capability based security[1].

Conceptually, it's elegant, and requires almost no changes in user behavior while solving entire classes of problems with minimal code changes. It's a matter of changing the default from all access to no access, all the way down to the kernel.

Life without it, is like trying to run a modern electrical grid without any circuit breakers, anywhere, ever.

Getting rid of virus scanners alone should be worth the platform switching costs, at least in terms of performance for most users.

[0] https://csrc.nist.rip/publications/history/ande72.pdf

[1] https://en.wikipedia.org/wiki/Capability-based_security

[2] https://en.wikipedia.org/wiki/Bell%E2%80%93LaPadula_model

Post reply on HN