Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why there are so many cybersecurity vendors and where do we go from here

ventureinsecurity.net

Post reply on HN
Print view View original

41–50 of 61 posts

Re: Why there are so many cybersecurity vendors and where do we go from here

#41

Post by Veserv »

PakG1 wrote: post #18
alephnerd wrote: post #17

It's all checkbox driven development. I'm a PM in the space and it's all snake oil. At least we have amazing ACVs compared to other B2B sectors and a captive market. F** Gartner and Forrester for forcing us to concentrate on this instead of actually solving problems

Sure, but there are SOME that aren't selling snake oil. I'm invested in one of them. But yeah, most are. I guess the interesting question for me is how long does it take for the real wheat to stand out from the chaff.

That is what they all say.

So how much would it cost to hire a hacker to breach a system deploying their solution?

I bet you if you asked their VP of engineering: “If I had one skilled hacker and a year, are there any non-trivial customer deployments that could stop me?” The answer would either be a resounding no or they would not be able to point to a single shred of evidence supporting their assertion like a red team exercise with those parameters.

Extraordinary claims require extraordinary evidence.

Re: Why there are so many cybersecurity vendors and where do we go from here

#42

Post by [deleted] »

int0x2e wrote: post #40
alephnerd wrote: post #17

It's all checkbox driven development. I'm a PM in the space and it's all snake oil. At least we have amazing ACVs compared to other B2B sectors and a captive market. F** Gartner and Forrester for forcing us to concentrate on this instead of actually solving problems

I work at one vendor currently and have worked at a few prior. The difference is astounding - my previous gigs, including one of the biggest vendors ever was exactly as you said. My current gig is exactly the opposite - strong focus on real security insights and value, none of the box-ticking bs, and a great roadmap. It is rare, but when everyone at the org, and especially the product side really know how attacks pla…

[deleted]

Re: Why there are so many cybersecurity vendors and where do we go from here

#43

Post by int0x2e »

sylens wrote: post #37
ChuckNorris89 wrote: post #13

Earlier quoted context omitted.

What logic did you use to come up with that statement? Tools like Nessus and Burpsuite Pro cost around 6-8k/year. Good luck hiring a security engineering department on a 8k/year budget that will build and maintain you tools of similar quality lol.

Tools like Nessus and Burpsuite Pro are not the ones I'm talking about. Go take a look at the CSPM or CASB or CNAPP space and check the costs on some of these tools.

Those aren't cheap, but rolling your own usually isn't any cheaper. Even huge enterprises usually buy instead of build because it's cheaper in both the short and long run.

Think about most managed cloud services - you could deploy your own SQL servers on EC2, configure replication, fail-over, backups, security patching, log collection, observability, etc. - but you'll end up paying a lot for engineers to build, maintain and monitor that solution compared to just spinning up one of the ready made offerings by AWS. It might be cheaper to do if you have a ton of RDS, but it really has to be a huge huge volume, and even then, AWS will probably find a way to discount your bills to make it still better...

Re: Why there are so many cybersecurity vendors and where do we go from here

#44

Post by int0x2e »

calvinmorrison wrote: post #22
sylens wrote: post #3

There is also another issue with cybersecurity vendors that this article doesn't touch on, and that's in the area of cloud security where many of them started targeting a specific use case or set of use cases, and have slowly expanded to overlap with other vendors who were not previously competitors. It's not good enough for a tool to just be used for Cloud Security Posture Management (CSPM) - it also has to do CI/CD…

Too many people do too much. I would rather pay 10 vendors a few K per year than get sucked into one vendor one tool suite. Let people focus dammit.

For enterprises, it's hard to have a ton of different tools. I worked at a very large software company, and our security tech stack was so big and convoluted, that just maintaining a compliant CI/CD pipeline was a 5 person job, because there are ~20 different tools to integrate and debug, and each of those changes every year or two, so you're constantly re-learning, re-integrating, debugging,etc. Having a single (or just a couple) vendor(s) sounds like a dream!

Re: Why there are so many cybersecurity vendors and where do we go from here

#45

Post by Veserv »

int0x2e wrote: post #40
alephnerd wrote: post #17

It's all checkbox driven development. I'm a PM in the space and it's all snake oil. At least we have amazing ACVs compared to other B2B sectors and a captive market. F** Gartner and Forrester for forcing us to concentrate on this instead of actually solving problems

I work at one vendor currently and have worked at a few prior. The difference is astounding - my previous gigs, including one of the biggest vendors ever was exactly as you said. My current gig is exactly the opposite - strong focus on real security insights and value, none of the box-ticking bs, and a great roadmap. It is rare, but when everyone at the org, and especially the product side really know how attacks pla…

Okay, but how much would it cost to hire a hacker or red team to breach your systems? Is it more or less than $10M? If I had one competent hacker and a year do you think you could stop me? How about three people and a year?

Re: Why there are so many cybersecurity vendors and where do we go from here

#46

Post by WatchDog »

mindslight wrote: post #25
hamandcheese wrote: post #12

My startup idea is cybersecurity software that does literally nothing. My competitive advantage would be speed, ease of use, low attack surface area, and perfect false positive rate.

I'm sorry to tell you, but it would fail. Being too fast would preclude creating attachment through the sunk costs required to run it. The ease of use would let users quickly determine that the software can't do what they want. The low attack surface would avoid necessitating widespread organizational buy in. And the zero false positive rate would mean that it wouldn't move the needle on any metrics.

Haha, CSO's love to talk about how they blocked 3 million hacking attempts.

In what amounts to tallying up dropped icmp packets.

Re: Why there are so many cybersecurity vendors and where do we go from here

#47

Post by int0x2e »

mikewarot wrote: post #9

>Where do we go from here? Take a step back, and look at history. It should be unsurprising that the problem was encountered, studied[0] and solved, decades ago. During the Viet Nam conflict, the Air Force needed to plan missions with multiple levels of classified data. This couldn't be done with the systems of that era. This resulted in research and development of multi-level security, the Bell-LaPadula model[2], an…

The difference between theory and practice, is that in theory there is no difference, but in practice - there is.

So far, every "provably secure design" I've seen ended up being insecure in practice due to the things people abstract away.

I'm not saying it's impossible, but I have not seen it done perfectly thus far.

We've seen more success by having many many iterations and widespread usage of common designs and patterns. These are not perfectly secure by any means, but they are secure enough against common threats to make it functionally equivalent until we figure it out.

Re: Why there are so many cybersecurity vendors and where do we go from here

#48

Post by mikewarot »

int0x2e wrote: post #47
mikewarot wrote: post #9

>Where do we go from here? Take a step back, and look at history. It should be unsurprising that the problem was encountered, studied[0] and solved, decades ago. During the Viet Nam conflict, the Air Force needed to plan missions with multiple levels of classified data. This couldn't be done with the systems of that era. This resulted in research and development of multi-level security, the Bell-LaPadula model[2], an…

The difference between theory and practice, is that in theory there is no difference, but in practice - there is. So far, every "provably secure design" I've seen ended up being insecure in practice due to the things people abstract away. I'm not saying it's impossible, but I have not seen it done perfectly thus far. We've seen more success by having many many iterations and widespread usage of common designs and pat…

I agree with all you've said.

I just feel that our proven insecure system, with default authority, is a really bad foundation to have settled upon. We couldn't have picked a worse default.

Re: Why there are so many cybersecurity vendors and where do we go from here

#49

Post by Veserv »

int0x2e wrote: post #47
mikewarot wrote: post #9

>Where do we go from here? Take a step back, and look at history. It should be unsurprising that the problem was encountered, studied[0] and solved, decades ago. During the Viet Nam conflict, the Air Force needed to plan missions with multiple levels of classified data. This couldn't be done with the systems of that era. This resulted in research and development of multi-level security, the Bell-LaPadula model[2], an…

The difference between theory and practice, is that in theory there is no difference, but in practice - there is. So far, every "provably secure design" I've seen ended up being insecure in practice due to the things people abstract away. I'm not saying it's impossible, but I have not seen it done perfectly thus far. We've seen more success by having many many iterations and widespread usage of common designs and pat…

Okay, name the "provably secure designs" that were actually proven and validated by a competent security standard such as the Orange Book Level A or Common Criteria EAL 6/7 that turned out to be insecure in practice.

Most people who say that point to designs that were never proven and never validated against anything meaningful, but I am open to seeing a actual example.

Re: Why there are so many cybersecurity vendors and where do we go from here

#50

Post by somescarygirl »

kyboren wrote: post #31

Because the people with purchasing authority know nothing about security, they are unable to distinguish real, good security practices and products from defective, over-hyped, and/or pointless "security" products constantly shilled at them. In other words, "cybersecurity" is a "Market for Lemons": https://en.wikipedia.org/wiki/Market_for_lemons A lemon market will be produced by the following: 1. Asymmetry of informa…

I think it's a bit more complicated than not knowing anything about security. It's more that security spans most other disciplines and security companies tend to focus on a subsection. In order to understand if a technology fits your use case and is effective often leads to long PoCs or trusting analyst, costing you time and/or money. Fun fact, most analyst firms like Gartner rarely touch a product and rely on the vendors to answer questions and send demos. It's very much a market for lemons because it's hard to actually test vendors' claims without a significant investment.
Post reply on HN