Cybersecurity Pros Name Their Price as Hacker Attacks Swell

not right. there are ALWAYS holes - it's the nature of software, hardware, and humans.

I am referring to a CIA (confidentiality, integrity, availability) related incident. Less so the availability. If an attack was truly motivated, the web stack / application stack is not how you compromise the system. The user is how you compromise the system. Do you have proper physical security to prevent unauthorized access? Do you have proper password and 2 factor auth configured? Do you educate your employees on how to identify phishing? There are numerous other ways to compromise a system than remotely via the web or application stack :)

The computing stacks for a typical modern corporation are too complex to be able to say with certainty that all the holes are plugged.

I guess the stack itself is probably so deep and wide generally that the attack surface goes on and on. More than anything though, humans. Staff can be exploited easier than anything else in a lot of cases (I'd wager, not my area of expertise).

> Correct me if I'm wrong, but If there's no holes in the application/web stack to be exploited, then there's no getting in. Right?

Right. But there's a saying. "Nothing in unhackable". There in lies the problem. If you can build an unhackable system you literally can get whatever salary you want. If you can convince someone that such a thing is possible. But I'm pretty sure that'd count as fraud.

I think you may be imagining a comprehensive numbered list of exploits. Some products are sold that indicate things like this.

It may be possible to write a software component that is not vulnerable to exploits, but any non-trivial system built of many components will almost certainly be exploitable.

As much as people say they value security, they also value delivery of working software.

Additionally, as others have said, no system is invulnerable from the CIA, NSA, KGB, etc. Someone knows the passwords (or where the passwords are stored) for your system. They may be vulnerable to bribery, blackmail, torture, etc.

hereabouts, banks adopted new procedures after some incidents involving staff's families being kidnapped.

How secure is the source integrity of all your dependencies?

All your software vendors?

How likely are you to get malware on an employee laptop?

Phish employee credentials?

Have somebody sneak into your office late at night and install keyloggers on everyone's keyboards?

Kidnap an employee's family and blackmail them into giving you access?

Go through your recruiting pipeline and join as an employee with the motive to steal your data?

Get two people to do the same and bypass peer review controls?

Of course those are getting outlandish and unlikely, but that depends how "motivated and skilled" your attacker is.

Software is only one part. Do you trust your hardware, your people, your supply chain, your physical security. "Truly motivated" can mean extreme resources and willingness to cross all boundaries.

Are you secure if your admin's child is kidnapped and the ransom demand is for network access? Are you secure from the Secret Police wanting to hijack your service for their purposes?

Once you accept you CAN'T stop truly all attacks you can be comfortable with acceptable risk and work to mitigate realistic risks.

Two problems with that - knowing about all of your holes, and whether or not they are plugged, is impossible. Second, many breaches don’t even involve holes in your web app stack. Low tech attacks like phishing and malicious attachments are remarkably effective to get a foothold into a network.

>Correct me if I'm wrong, but If there's no holes in the application/web stack to be exploited, then there's no getting in. Right? It's not about hacker/pirate skill. It's about whether or not the target has plugged all their holes or not.

Similarly if a ship is unsinkable the passengers will never drown. Easier said than done.

How about: “No amount of controls will stop someone truly motivated, skilled, and lucky.”

They'll just rubber-hose your teenage son until you give it up. I'd certainly give up a database password before I'd let my son get beaten by Bin Laden.

Or if they're not SuperMicro, then you'll buy hardware with a https://en.wikipedia.org/wiki/The_Thing_(listening_device) in it

Good luck patching all the humans that work at, or with, your organization.

Unfortunately it is never that simple. Even if you have thing well plugged on your end, other software /services that interact may provide a path. I recall one instance a few years ago where a hacker chained password recovery services together to breach an apple account, by bouncing through Amazon. One of the password recovery methods for Apple at the time was providing the billing address, and at Amazon you could recover a password by providing the full CC# of a card on file. But Amazon also let you add a CC# for an account you weren't logged into, so the hacker got a Visa giftcard, added it to the Amazon account of the victim, reset the Amazon password with that CC#, and then used the shipping address in Amazon to recover the Apple account password.

Then there are the security holes that exist and are known about by select groups which they sit on and use for big plays...

a hacker needs only one hole. The security pro has to plug all of them. it s a rigged game that inevitably costs disproportionally

Read up on Microsoft's Assume Breach strategy. A mature organization has to embrace thinking beyond prevention.

https://gallery.technet.microsoft.com/Cloud-Red-Teaming-b837...

There is no plugging all of the holes. Not in a general case. It's like the halting problem (it's technically equivalent) - maybe you can say for one program there are no holes, but not for arbitrary programs, for arbitrary definitions of holes.

This is rice's theorem.

More practically, you can simply assume that for an arbitrary program of 'reasonable size' with a moving codebase there are effectively infinite exploitable vulnerabilities.

Please, share with us your application stack that has no holes.

Yes, "someone truly motivated and skilled" is a useless statement.

The bar can be raised quite high.

> It's about whether or not the target has plugged all their holes or not.

You're not exactly wrong, but you're assuming something that's impossible. How do you know where all the holes are? You (I'm using the generic you here, as though speaking to a CIO) cannot even inventory all the net-connected software and hardware you own, and even if you could the list would be out of date in 24 hours. But let's say you had that fictional inventory. How do you find its vulnerabilities? You might be able to design an automated process to look at your source code and match against the CVE database. Whoops! You don't have source code for most of your resources because they're proprietary and came from outside vendors. So maybe you look at object code. There are tools that do that. Whoops! A lot of the code is in ROM and you cannot extract it. Even if you could extract all your object code and analyze it against CVEs (which you can't), that's only going to catch known vulnerabilities. What about the unknown ones?

Oh and now we have to talk about all the stuff that's not net-connected which is vulnerable to employees plugging in USB drives...

So no, you can't know where all the holes are so there's no way to patch them all. This doesn't mean security is impossible. It just means there's no such thing as perfect security and there are no magic bullets. Security is a necessary, expensive, and mostly boring part of any company's day-to-day business operations, like, say, accounting and the legal department. But that's not quite right, because most of your employees probably don't need to know much about accounting or the law. But they do need to understand the basics of safe computer use, so ongoing training should be a fat budget line item.

Anyway security is a process, not a thing you can just buy a little of from a vendor. You ignore the security process at your peril.

Everyone is trying to get a piece of the pie :) trickiest thing right now is defining what an "asset" truly is.

An asset could be ephemeral cloud infrastructure, an uncompiled piece of code, an API endpoint, a server, a compiled application, a third party vendor, a group of microservices, a fax machine, an employee, a filing cabinet with sensitive information, a virtually defined CI/CD pipeline, and a million other things. At what point do you cross line from paranoia to proper asset inventory, tracking, triaging, remediation, etc. How do you find commonality between all of these devices, critical infrastructure, and data?

Bonus points of trickiness, how do you manage inventory when it changes constantly like cloud, like a third party, a web app, etc. Things like certificate management get extremely dicey. Where do you cross the line between data management, asset management, etc. It's currently the most open area of IT and Cyber that there is, and no one, in my opinion, has a grip on it.

A combo of in house tools for creating findings from "non-standard" tools, (standard tools being nessus, app scan, etc.) Such as pen tests, responsible disclosure, red teamings, etc. We partner with Kenna Security pretty heavily in terms of tracking and consolidating our vulnerabilities, along with remediation prioritization and strategy

Might want to fix the Lorem Ipsum on the homepage for mobile towards the bottom :) for example

HIPPA Compliance Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nunc quam urna, dignissim nec auctor in, mattis vitae leo.

GDPR Compliance Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nunc quam urna, dignissim nec auctor in, mattis vitae leo.

PCI Compliance Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nunc quam urna, dignissim nec auctor in, mattis vitae leo.

from your website: HIPPA should be HIPAA

The word cyber is almost exclusively used when discussing security of computer systems. It's used very heavily by government and academic circles and it propagates to other industries from there.

In the 90s I used the word to describe an instant messenger version of "phone sex" and I haven't been able to take anyone that uses the term seriously after that, but I never really took the goverment or academia seriously to begin with.

It's a term that's been adopted out of necessity.

Yeah, not only is "Cybersecurity" a "Thing" (I work in s/w security and hear it all the time) but people still talk about "Artificial Intelligence" when they mean image filters and classifiers, and have been doing so since the 1980's.

Language fires the imagination. This is mostly a good thing. Sometimes it's also stupid, but not necessarily bad for it.

It’s usually used by either people working with the government, or by people who are tech-illiterate (marketing etc). The rest of the security industry is likely to snicker if they hear that word.

Could you say more? Describe a possible company.

We need to go back to the client Server Days! It's much more secure to run IIS on WinNT! -Grandpa

I keep telling people that the person who applies the patches needs to be qualified, paid, AND TRAINED just as much as the guy who wrote the fancy paper on maintaining security, and that development and infrastructure need to be more simplified, otherwise security will likely not be implemented properly... companies rarely heed the warning. And that leads to breaches that PR teams get paid a LOT within companies fight furiously to squash.

Agreed on most points except in some cases where CISOs are actually people who rise up through the ranks within security and actually know their shit. But I concede that its not very common.

I don't know what they did at Microsoft, but this is just pants-are-shirts wrong for SFBA tech companies. I could tell you I know this from near-firsthand experience (getting offers, watching friends get offers, for both SDE and security roles, as well as doing technical recruiting work for our clients, who are almost all SFBA startups), but you're also responding to someone giving you firsthand knowledge at Netflix.

The people telling you security talent commands a premium are not lying and they're not wrong.

There is a general instinct people have to push back on "look at these high salaries" data points because, not to put too fine a point on it, they're not good negotiators and get second-tier offers. That includes a lot of people with truly extraordinary talent; negotiating skill and delivery skill are, of course, orthogonal. But even that is changing; all you have to do is keep your ear to the ground to know that the standard SFBA SDE salary is not the market clearing rate for (e.g.) software security.

Most of my years spent in the cyber security space revolved around consulting with large companies. The most common activity we consulted on was cyber security related technical transformation. Basically a company would hire a new security manager or CISO who had all their favorite security solutions and vendors. So everything already implemented had to be replaced with the CISO preferred solution. This kept an army of consultants and business analysts and project managers in business as well as gave the security org the feeling they were making a difference.

Might not be the case everywhere but was certainty the norm in the consulting world.

> How do you know what everyone was paid?

We talked pretty openly about salary. Also, managers, or anyone involved in setting pay, had a spreadsheet of all the engineers salaries for level setting purposes.

Who cares how the role is classified in the payroll system? That’s now how anyone serious determines what an individual’s compensation is.

I definitely feel like I have much more negotiating power than eng, as someone who used to be in an eng role and is now in security. There are more engineers and eng is a less niche skillset. There are very, very few people with my skillset. Hiring for my team takes months, minimum, with far far fewer candidates in our pipe.

I work at an SF company and routinely field offers from other companies that I can view on levels.fyi, and my colleagues in eng are open with me about their salaries so I have lots of datapoints to compare to.

To your other comment:

> I seriously question whether you understand how mediocre the mean security engineer actually is, even at top tier companies

This seems equally true for eng.

Your username is cool. m tired of cooperate bs. just want to sit in my lawn on my chair.

There are a lot of ways you are flat wrong about this issue.

I was a CSO at a large technical company and we were successful in separating the role of Security Engineer from regular Engineer with HR.

With regard to corporate politics, you have hit on an interesting aspect of the problem. Why is it that politics should trump the actions taken to prevent breaches?

The CSO/CISOs that I know all have this stress of knowing what the risks are and the difficulty of moving the organization, incrementally, towards a safer posture. Successful ones know how to navigate whatever the culture is and somehow produce a solution.

The underlying causes of breaches really come down to 1. the corporate culture, 2. the technical competence of the organization, top to bottom, and 3. the strength of the security team. If the security team up through the CSO is very good and the culture is not so good (recent breaches will give you names), or the technical competence of the company is low (e.g., putting a breach response site on the internet disconnected from your root domain), then the effectiveness of the CSO is not very good.

There is a fundamental tension between spewing off features to win market share and producing quality, secure software.

A wise company will find a CSO who can help move the culture and influence the technical practices. Those folks are very rare, and as such will have very high pay.

>>Nobody is doing anything to try reduce or manage complexity so it's only getting worse.

I disagree, I see a number of large corporations starting to standardize either 1) their entire development stack from IDE all the way to how the code is deploy 2) Reengineering entire languages to have one language be used e.g Quartz at BofA 3) at the very least, companies are starting to standardize their middleware stacks, to at least avoid the configuration related issues of having a development team managing that.

While I do agree, that the complexity of third party libraries has exploded and is increasingly difficult to manage, I'd say companies are well on their way to standardizing that, with tools like Nexus, SonaType, Blackduck, etc.

We're obviously a long ways away from being even 75% effective across the board, but to say nobody is managing the complexity is a bit short sighted :)

We're trying to address this. If you've got sometime I'd really like to compare notes on this and learn how you guys work day-to-day. We're leveraging Osquery to asses the various aspects of systems to try and build threat models where risk cascades as systems change. To help facilitate automated reporting. Alongside the traditional mundane cybersecurity day-to-day activities.

Don't forget helm charts and docker containers. The security/assurance of that supply chain is pretty lacking.

It feels like some people are actively applying the (historical?) Wordpress security model to Kubernetes for expediency.

Do enough people actually use Snap or Flatpak (especially at large companies) to make it worth anything? I’d imagine that most people would just use real distro packages and stuff compiled from source instead of trusting Snapcraft or random Flatpaks off the Internet, especially in production.

Smart contract auditing = block chain? Are those jobs still around? I thought that had a 1 year shelf life

I dunno about some of this; working for a security company in a non-security software role gets you a lot of adjacent experience (take extra courses mandated by the company, go to extra talks, work with super smart security people), but I don't consider myself anything like an actual security expert after doing this for nearly 8 years.

There's a lot of not-security work to be done in the security industry, and it's not all work that gives you security-specific experience. I like to think I'm good at what I do, but it's not security, even though it's to help security people.

Certs are not important. No real security person is going to care about a cisco cert either way.

It's the same thing as formal software engineering specs.

Unless you're doing software for airplanes, ain't noone formally proofing anything being done.

Plus Security Expert is incredibly vague. Like what do you do? Are you a pen tester? SIEM analyst? Compliance? Do you work in SecDevOps? Or are just a firewall/IDS guy? Or maybe you walk around the office and hit your accountants every time they click on a phishing link with a wiffel ball bat.

The world of info sec is so massive that saying you are a expert in 'Security' is useless.

I rarely see the concept of "supply and demand" used properly.

In introductory economics, it's just two lines crossing somewhere. In reality though, companies still have to make a buck, so there is a definite limit on how much a company can pay a "security professional" and still be profitable.

And worse, if we are talking about a labor shortage across an industry or country, price doesn't really come into it at all. Price is only a competitive factor, it doesn't create or destroy individual developers. If one employer "scoops" an employee for a higher price, the shortage moves to where he just left.

Sucking in talent from other industries or countries also has its limits. And on top of all of that there seems to be some anti-competitive effects preventing wage-wars.

Unmet demand is a thing, though.

Do the folks you know that are doing this full time actually depend on that income for their livelihood? I was on the receiving end of a large program for a short stint and have been watching it casually over the past few years. It's very much a feast and famine way to live, and you need to not only be very skilled, you also need to be dedicated to the effort and be very disciplined with your money. A $20K chained RCE looks great on paper until you're trying to live on a constant diet of clickjacking and IDOR bugs for two months straight.

I would caution anyone thinking about this to do it as a side hustle for at least six months if not a year to test the waters, understand the subculture a bit, and take a few rounds on the roller coaster.

hmm. u got there a fancy email.

I'm curious of the actual top figure is?

That might not be saying much depending on the country...

> 5x - 10x of an average software engineering salary for his home country.

...which might still be 0.2x of an average Google salary in Mountain View, as noted above.

The fact that you even mention "home country" pretty much requires that you give us specifics if you want us to take the claim seriously.

m curious to know number of top contributors or is it just single one ? well then, even top AI guys earn lot compare to normal SDE.