F5 says hackers stole undisclosed BIG-IP flaws, source code

>it shifts accountability away

I agree. I think what we are split on is purpose/intent.

>could not reasonably be expected to protect against.

Why not? If I'm hiring a cybersec thats probably in my top 3 reasons to hire them, if not them then who? Number one is probably compliance/regulation.

> “get out of jail free”

This is one of my red flags I also keep seeing. Whoops we can't do the thing we say we do. The entire sec industry seems shady AF. Which is why I think they are a huge future rent seek lobby. Once the insurance industry catches on.

> these reports get used to fund the security program

So we agree?

It's a bit like copspeak's fondness for mentioning "individuals" (otherwise known as "people.") It's just a kind of shibboleth. "State actors" is just as clear and means the same thing.

> I agree. I think what we are split on is purpose/intent.

I… don’t think so? Your original comment was that companies claim nation state attack as a way to get government funding. That has nothing to do with assessing blame for an attack.

> Why not? If I'm hiring a cybersec thats probably in my top 3 reasons to hire them, if not them then who?

If you think you as a private entity can defend against a tier 1 nation state group like the NSA or Unit 8200, you are gravely mistaken. For one thing, these groups have zero day procurement budgets bigger than most company market caps.

That’s why companies reflexively blame nation state actors. It isn’t to get government funding. It is to avoid blame for an attack by framing it as something they could not have prevented.

> So we agree?

No, I don’t believe we do.

Personally, I think its worse. The whole point of employing a company like F5 is precisely to protect against those kind of "nation-state" actors.

If F5 can't do that, what is their actual value proposition?

This is a mean-spirited interpretation of what happens when you claim nation state.

Generally the government (as of now) is not paying private (but maybe some Critical Infrastructure companies) companies to secure things. We are in the very early stages of figuring out how to hold companies accountable for security breaches, and part of that is figuring out if they should have stopped it.

A lot of that comes down to a few principles:

* How resourced is the defender versus the attacker? * Who was the attacker (attribution matters - (shoutout @ImposeCost on Twitter/X) * Was the victim of the attack performing all reasonable steps to show the cause wasn't some form of gross negligence.

Nation state attacker jobs aren't particularly different from many software shops.

* You have teams of engineers/analysts whose job it is to analyze nearly every piece of software under the sun and find vulnerabilities.

* You have teams whose job it is to build the infrastructure and tooling necessary to run operations

* You have teams whose job it is to turn vulnerabilities into exploits and payloads to be deployed along that infrastructure

* You have teams of people whose job it is to be hands on keyboard running the operation(s)

Depending on the victim organization, if a top-tier country wants what you have, they are going to get it and you'll probably never know.

F5 is, at least by q2 revenue[0], we very profitable, well resourced company that has seen some things and been victims of some high profile attacks and vulns over the years. It's likely that they were still outmatched because there's been a team of people who found a weakness and exploited it.

When they use verbage like nation-state, it's to give a signal that they were doing most/all the right things and they got popped. The relevant government officials already know what happened, this is a signal to the market that they did what they were supposed to and aren't negligent.

[0] -https://www.f5.com/company/news/press-releases/earnings-q2-f...