Do security companies really care about security.

Mitechniq

I wanted to discuss a point of frustration I have had in the last couple of months. Part of my job is to evaluate new security technologies for my company. I won't mention names but do these companies really care about security. Let me give you some examples:

One company offers a vulnerability scanner, but their password file is unencrypted in the database, they do not allow you to change the self-signed cert in the application and their streams to communicate with end devices still uses SSLv3.

Another company offers a compliance and regulatory checker, it is an ova with a Linux server as the OS. When I asked how do I update and patch the server, the company consultant had no clue. So you make sure all my OTHER servers are compliant, but your server could potentially be the way a hacker gets into my environment.

Finally, I had to register my information to one company which asked for some personal information including my social, but their webpage is HTTP. Huh, you cannot afford 40-100 dollars for an SSL cert and your supposedly a Security Company.


I compare this to a director who is an atheist but loved making Christian based movies because of the potential profit.

iBrokeIT

First rule of security vendors... do not talk about the security of their product!
Second rule of security vendors... do not talk about the security of their product!
...

E Double U

Do companies only care about money? Yes, yes they do!

renacido

Maybe they have a bug bounty program you can take advantage of. If so, don your white hat and do a proof of concept hack in your lab, and make some side money while providing a valuable service.

Or, you could just tell them their platform has security vulnerabilities and for that reason their bid has been eliminated from consideration. Vote with your wallet as they say.

tpatt100

I think now a days if you want a company to acknowledge your concerns post it on their Facebook and Twitter page. It seems companies jump on concerns ASAP when it's brought up on their public online presence.

dustervoice

I've always heard people say "Barbers have the worst haircuts and a mechanic's car are always broken" maybe the same saying should apply to security vendors.

Matt2

I know of a hosting provider which provides service offerings to take most of the load off their customers to be compliant for various industry standards and regulations. And yet, the systems they maintain and monitor clearly should fail audits based on configuration alone. And it's not possible to truly "trust but verify" the work they are doing. Well you are supposed to trust without verifying enough of it.

I have little faith in any company, they have to prove themselves to me before I accept they are as secure as they claim.

gespenstern

Of course they don't. Any company cares about money (i.e. business) first and everything else is an afterthought. Apparently their business goes well so far even without these security controls. Why would they care to implement them?

Actually recently I hosted a security meetup where I proved with numbers that Target Corp didn't care about information security and hackers and still doesn't care about it. Moreover, it is a right decision from a purely business standpoint as they didn't lose their own money to hackers, their damages are collateral only and they save much more each year from outsourcing to India, underbudgeting and understaffing than all their damages combined because of the breach.

Mishra

Valid frustration.

I've seen so many products developed in horrible ways. Just be happy that you have the gift to be able to find those nuances. There are many scenarios where the company lacked that person in their architect role when developing the product.

UnixGuy

Care?? companies don't 'care' or feel, they're out to generate revenue. They will do the minimum to get the most revenue.

fuz1on

Companies only care about their ROI.

Params7

Generally, its the hackers which tend to be more passionate about technology, and finding new breakthroughs while employees doing it for the paycheck are mostly playing catchup.

SaSkiller

The issue is a difference between departments. Sales staff will straight lie about the capabilities of a product or overstate it to make a sale.
Dev staff are subject to the same requirements as other companies, get a product ready for release.

Now usually there is a corps of individuals within the company who do care about security, but their power is relatively limited.

In the end, doing things the right way doesn't bring the company money and it isn't easy.

TechGromit

We use a solution called OWPWAT, they combine many different engines together to scan each file. There a website below you can try.

https://www.metascan-online.com/#!/scan-file

Anyway, if you scan a file, you'll see the anti-virus definitions are over 789 days outdated. You would think they would be more proactive in keeping there scanning engines up to date. While they do keep the engines updated for the service we pay for, it doesn't present a good first impression when your free services are not.

Params7 wrote: »

Generally, its the hackers which tend to be more passionate about technology, and finding new breakthroughs while employees doing it for the paycheck are mostly playing catchup.

Well to be fair hackers can make 100k from one breach, there's a lot of financial incentive to be passionate about technology. While some employees are well paid, generally they are not earning the kind of return on investment hackers can with there skills.

scaredoftests

only when they get hit, badly.

jeremywatts2005

A company I worked for in the past provided a one hour external pen test. Enough said about companies caring about security. It was just enough in some cases to pass and companies took advantage of it. What can your really test in one hour of a network that you have no idea about. You just start running random attacks as quick as you can and doing NMAP scans.

cyberguypr

What are you talking about? One hour is more than enough to test port 80 and tick that "Independent penetration test completed" checkbox

zxshockaxz

cyberguypr wrote: »

What are you talking about? One hour is more than enough to test port 80 and tick that "Independent penetration test completed" checkbox

I could not help but laugh at this. lol

OP, I have made this same observation. I hate/have to agree with everyone else when they say that companies care about money first.

bigdogz

A 1 hour Pen Test... are photos developed as well?
Seriously, I think that it would be a start and better than nothing at all. Some IT managers are very cheap and don't really have an understanding, until they lose their job because of it.

As a MSP, we really try to provide layers of defense and it really comes down to pride. Sometimes the tools are their but the execution is done poorly for a myriad of reasons.

TechGromit

jeremywatts2005 wrote: »

A company I worked for in the past provided a one hour external pen test.

I'm curious, who did they get to agree to do a one hour pen test? I wouldn't think any reputable Pen tester would agree to perform it. There no money in it and if/when the company get hacked, do they really want there names associated with this "penetration" test. Like the company wouldn't hesitate to say that we thought we were secure, ABC security consults did the pen test, it's there fault we got hacked.