31–40 of 83 posts
Fixing cybersecurity with laws is the same as fixing drug trafficking with laws
> You see, cybersecurity is broken because of the lack of consequences. It's really that simple. To put a slightly more explicit phrasing around the blog's message: Consequences fall on the wrong people . The ones screwing up chasing profit are not the ones feeling the pain. The damage falls on the innocent people the companies were trying to use as resources. This can be broadly classed as an economic externality, m…
Consequences are happening. People just don't see them because this happens well above the IC pay grade and takes some time to percolate down and no one wants to publicly announce you shitcanned 5-10 people in middle management and security leadership because you enter thorny employee litigation territory. That said, I agree with the author about mismatched expectations, though I can safely say that $500k year is VER…
As a security engineer, I agree. I hang up and work with really skilled people, so sometimes I'm shocked when I work with a client's it security engineer and they barely know how to use a terminal. Sometimes don't even have a way (or skill) to use SSH. Not to mention that I code/script every day, and most "standard" big company security engineers just use ready made tools.
Sorry for the rant.
>I don't give a rat's ass that you like using Mosh or xyz project on GitHub (not trying to pick on Mosh). >I don't care that you feel restricted by having to use MacOS laptops and SSHing into a CoLo protected behind ZPA when you'd rather use ArchLinux on your work laptop.
I somehow agree with your examples, but not sure if I agree with the overall idea behind your messages (as written). People have different workflows, and forcing everyone to the same mediocre one will just hurt productivity. Of course there need to be standards, but if people feel restricted by having jump through hoops on unfamiliar operating systems and spend a lot of time and frustration fighting them... Then they're probably right. You should listen and give way more than rat's ass to engineers problems.
It takes time.
Earlier quoted context omitted.
Consequences are happening. People just don't see them because this happens well above the IC pay grade and takes some time to percolate down and no one wants to publicly announce you shitcanned 5-10 people in middle management and security leadership because you enter thorny employee litigation territory. That said, I agree with the author about mismatched expectations, though I can safely say that $500k year is VER…
>If I'm honest, most security engineers suck. 90% are crappy IT Admins or Compliance Monkeys who did CISSP and maybe worked for PWC or an MDR for 1-2 years and don't know the difference between NFTables and NTFS As a security engineer, I agree. I hang up and work with really skilled people, so sometimes I'm shocked when I work with a client's it security engineer and they barely know how to use a terminal. Sometimes…
I completely agree with you!
I think all us people in the cybersecurity space are cranky ;)
But it also brings up a good point. I feel bad quality User Experience is a critical cause for bugs and misconfigurations. And UX isn't just "look pretty" - it's about optimized and simplified workflows.
> most "standard" big company security engineers just use ready made tools
I've worked for vendors and have funded vendors, so I might be biased, but ready-made tools can be helpful.
The issue is if you are using tools without understanding the underlying architecture or design of your platform.
If you're just a script-monkey and only concentrating on the what, security automation is going to take your job away (and is already in the pipeline in the IR world as we speak)
> Sorry for the rant
No worries. You yourself replied to my rant XD
"When literally nothing happens when some stupid service gets popped and loses your data they had no business collecting in the first place, this kind of thing will happen over and over and over again." Money quote, and he's right. In Europe, the GDPR helps stop random data collection, but there is still no penalty for getting hacked and losing customer data. There should be, and in egregious cases upper management s…
Earlier quoted context omitted.
Memory safe languages are nearly irrelevant. Last time I looked, freaking injection attacks still held the top place among vulnerabilities. Even companies that take testing seriously rarely test for security problems. This needs to change.
Injection attacks AFAIK have held the top place since forever. It is why people keep buying WAF's.
What? Mandate a bunch of paper-thin worthless rules that tie up security & engineering teams and don’t actually add measurable security improvements?
I’d be very interested in seeing the data that shows PCI-DSS has had any impact. I spent a previous life breaking into PCI compliant companies, and it didn’t offer the tiniest speed bump.
This is a horrible recommendation.
"Memory unsafe languages" is maybe one percent of one percent of the problem. As always, nobody actually gives a damn about "security" and uses it as a pretext to push something unrelated. (In this case, Current Year's stupid fad programming language.)
No. Put C out to pasture -- or just take it behind the barn and shoot it. Entire classes of severe bugs Just Go Away when you switch to a memory-safe language. Not all bugs, obviously, but the vast majority of the low-hanging fruit.
10 years from now: AI somehow knows every single tiny detail about your life and can accurately predict any decision before you even made it. How could it have come to this? Clearly, it's just the fundamental superiority of AI compared to the human intellect. It's just the inevitable march towards the singularity. There is nothing we could have done to prevent this...