Why there are so many cybersecurity vendors and where do we go from here • Hacker News Board

Re: Why there are so many cybersecurity vendors and where do we go from here

#51

Post by Veserv » Fri, Jul 07, 2023, 12:49 AM UTC

somescarygirl wrote: post #50

kyboren wrote: post #31

Because the people with purchasing authority know nothing about security, they are unable to distinguish real, good security practices and products from defective, over-hyped, and/or pointless "security" products constantly shilled at them. In other words, "cybersecurity" is a "Market for Lemons": https://en.wikipedia.org/wiki/Market_for_lemons A lemon market will be produced by the following: 1. Asymmetry of informa…

I think it's a bit more complicated than not knowing anything about security. It's more that security spans most other disciplines and security companies tend to focus on a subsection. In order to understand if a technology fits your use case and is effective often leads to long PoCs or trusting analyst, costing you time and/or money. Fun fact, most analyst firms like Gartner rarely touch a product and rely on the ve…

No, they do not know anything about security. Find me a CISO or VP of engineering that will dare to openly claim they can protect against a hacker/red team with $10M and would accept a challenge proving that. Frankly, I doubt you could even find one at $1M, let alone $10M as most Fortune 500 CISOs my colleagues and I have talked with usually peg the number at closer to $100K. Attackers with literal chump change like $10M are viewed as impossible threats, it is ridiculous. The entire commercial IT industry is systemically incompetent by multiple orders of magnitude with respect to actual software security.

Re: Why there are so many cybersecurity vendors and where do we go from here

#52

Post by zie » Fri, Jul 07, 2023, 1:03 AM UTC

Veserv wrote: post #51

somescarygirl wrote: post #50

Earlier quoted context omitted.

I think it's a bit more complicated than not knowing anything about security. It's more that security spans most other disciplines and security companies tend to focus on a subsection. In order to understand if a technology fits your use case and is effective often leads to long PoCs or trusting analyst, costing you time and/or money. Fun fact, most analyst firms like Gartner rarely touch a product and rely on the ve…

No, they do not know anything about security. Find me a CISO or VP of engineering that will dare to openly claim they can protect against a hacker/red team with $10M and would accept a challenge proving that. Frankly, I doubt you could even find one at $1M, let alone $10M as most Fortune 500 CISOs my colleagues and I have talked with usually peg the number at closer to $100K. Attackers with literal chump change like…

Agreed. There is a reason OWASP's top 10 barely ever changes, source: https://medium.com/digitalfrontiers/changes-in-owasp-top-10-...

Re: Why there are so many cybersecurity vendors and where do we go from here

#53

Post by sylens » Fri, Jul 07, 2023, 2:15 AM UTC

int0x2e wrote: post #43

sylens wrote: post #37

Earlier quoted context omitted.

Tools like Nessus and Burpsuite Pro are not the ones I'm talking about. Go take a look at the CSPM or CASB or CNAPP space and check the costs on some of these tools.

Those aren't cheap, but rolling your own usually isn't any cheaper. Even huge enterprises usually buy instead of build because it's cheaper in both the short and long run. Think about most managed cloud services - you could deploy your own SQL servers on EC2, configure replication, fail-over, backups, security patching, log collection, observability, etc. - but you'll end up paying a lot for engineers to build, maint…

Perhaps I was too cavalier in my original comment, but when I said building tools built on open source software, I meant leveraging things like Matano (matano.dev). So you’re not writing everything from scratch but you are responsible for wiring everything up to fit your environment.

And you’re right, it’s not going to be a universal truth - there will probably be some tool you end up buying. But I’d like to have a security engineering team that is forging something that will fit my organization like a glove instead of us trying to bend over backwards to make some big off the shelf tool fit with all of its features.

Re: Why there are so many cybersecurity vendors and where do we go from here

#54

Post by jamesfinlayson » Fri, Jul 07, 2023, 2:19 AM UTC

sylens wrote: post #3

There is also another issue with cybersecurity vendors that this article doesn't touch on, and that's in the area of cloud security where many of them started targeting a specific use case or set of use cases, and have slowly expanded to overlap with other vendors who were not previously competitors. It's not good enough for a tool to just be used for Cloud Security Posture Management (CSPM) - it also has to do CI/CD…

> There is going to be a lot of tool consolidation at most organizations coming in the next few years. Already happening where I work - multiple security tools being phased out because of tools that do everything now.

Re: Why there are so many cybersecurity vendors and where do we go from here

#55

Post by jamesfinlayson » Fri, Jul 07, 2023, 2:23 AM UTC

pwarner wrote: post #14

I wonder if there is an in here for open source? At least parts of the solution? The problem seems very much to be a data problem, and a code quality problem. Maybe OSS could help with the latter at least?

I thought that some of these tools had a lot of open source components (look at https://github.com/aquasecurity for example) but they can still charge lots of money because it's yet another service that a company doesn't want to host/configure/maintain themselves.

Re: Why there are so many cybersecurity vendors and where do we go from here

#56

Post by somescarygirl » Fri, Jul 07, 2023, 2:28 AM UTC

Veserv wrote: post #51

somescarygirl wrote: post #50

Earlier quoted context omitted.

I think it's a bit more complicated than not knowing anything about security. It's more that security spans most other disciplines and security companies tend to focus on a subsection. In order to understand if a technology fits your use case and is effective often leads to long PoCs or trusting analyst, costing you time and/or money. Fun fact, most analyst firms like Gartner rarely touch a product and rely on the ve…

No, they do not know anything about security. Find me a CISO or VP of engineering that will dare to openly claim they can protect against a hacker/red team with $10M and would accept a challenge proving that. Frankly, I doubt you could even find one at $1M, let alone $10M as most Fortune 500 CISOs my colleagues and I have talked with usually peg the number at closer to $100K. Attackers with literal chump change like…

Why would anyone who knows security make that claim? There's so much more than just software security. Even if you secured every bit of code your company wrote that wouldn't make you secure. How much does solving for every OWASP top 10 vuln help when only 10% of your product is software your devs wrote? What about the open source libraries or non software parts of the business? You can't run a company without using some amount of 3rd party software or having at least a few employees that need to communicate using chat or email. While I'd agree there a lot of incompetence out there, I think the problem is much harder because there's a lot of variables out of your control. Now we're back at the original problem of how do I try to control for people and vendors I have to work with and there's a huge imbalance of information.

Re: Why there are so many cybersecurity vendors and where do we go from here

#57

Post by ecdavis » Fri, Jul 07, 2023, 3:14 AM UTC

int0x2e wrote: post #47

mikewarot wrote: post #9

>Where do we go from here? Take a step back, and look at history. It should be unsurprising that the problem was encountered, studied[0] and solved, decades ago. During the Viet Nam conflict, the Air Force needed to plan missions with multiple levels of classified data. This couldn't be done with the systems of that era. This resulted in research and development of multi-level security, the Bell-LaPadula model[2], an…

The difference between theory and practice, is that in theory there is no difference, but in practice - there is. So far, every "provably secure design" I've seen ended up being insecure in practice due to the things people abstract away. I'm not saying it's impossible, but I have not seen it done perfectly thus far. We've seen more success by having many many iterations and widespread usage of common designs and pat…

Cool talk to watch:

Guarding Against Physical Attacks: The Xbox One Story — Tony Chen, Microsoft

https://www.youtube.com/watch?v=U7VwtOrwceo

Re: Why there are so many cybersecurity vendors and where do we go from here

#58

Post by Veserv » Fri, Jul 07, 2023, 4:21 AM UTC

somescarygirl wrote: post #56

Veserv wrote: post #51

Earlier quoted context omitted.

No, they do not know anything about security. Find me a CISO or VP of engineering that will dare to openly claim they can protect against a hacker/red team with $10M and would accept a challenge proving that. Frankly, I doubt you could even find one at $1M, let alone $10M as most Fortune 500 CISOs my colleagues and I have talked with usually peg the number at closer to $100K. Attackers with literal chump change like…

Why would anyone who knows security make that claim? There's so much more than just software security. Even if you secured every bit of code your company wrote that wouldn't make you secure. How much does solving for every OWASP top 10 vuln help when only 10% of your product is software your devs wrote? What about the open source libraries or non software parts of the business? You can't run a company without using s…

If your dependencys are out of your control then you are incompetent at security, full stop. Wrangling your dependencys and inputs is security and engineering 101. You will not get meaningful security without doing so. Being unable to do a critical part of the job because it is hard is textbook incompetence.

Everybody everywhere in software being totally slipshod on these elementary practices is a big part of why there is no meaningful security anywhere.

Re: Why there are so many cybersecurity vendors and where do we go from here

#59

Post by bobby_the_whale » Fri, Jul 07, 2023, 9:56 AM UTC

Veserv wrote: post #45

int0x2e wrote: post #40

Earlier quoted context omitted.

I work at one vendor currently and have worked at a few prior. The difference is astounding - my previous gigs, including one of the biggest vendors ever was exactly as you said. My current gig is exactly the opposite - strong focus on real security insights and value, none of the box-ticking bs, and a great roadmap. It is rare, but when everyone at the org, and especially the product side really know how attacks pla…

Okay, but how much would it cost to hire a hacker or red team to breach your systems? Is it more or less than $10M? If I had one competent hacker and a year do you think you could stop me? How about three people and a year?

[dead]

Re: Why there are so many cybersecurity vendors and where do we go from here

#60

Post by buffet_overflow » Fri, Jul 07, 2023, 3:08 PM UTC

WatchDog wrote: post #46

mindslight wrote: post #25

Earlier quoted context omitted.

I'm sorry to tell you, but it would fail. Being too fast would preclude creating attachment through the sunk costs required to run it. The ease of use would let users quickly determine that the software can't do what they want. The low attack surface would avoid necessitating widespread organizational buy in. And the zero false positive rate would mean that it wouldn't move the needle on any metrics.

Haha, CSO's love to talk about how they blocked 3 million hacking attempts. In what amounts to tallying up dropped icmp packets.

A long time ago at a previous job, I had to report monthly on metrics relating to firewall deny events. I got an angry phone call to my desk phone from an executive, demanding to know why firewall deny events were down 10% in the previous month. Their tone changed when I mentioned the month in question was February, which conveniently is about 10% shorter than January.