Liquidmatrix Security Digest Podcast - Episode 63

Episode 0x63

May The Forth Be With You!

Dave's here. Wil's here. Matt's here. Ben's here. I'm here. There's a guest (or two) HOLY CRAP IT'S A REGULARLY SCHEDULED LIQUIDMATRIX PODCAST. Also, Dave claims he's fixed the website - we'll see how that goes.

Upcoming this week...

Lots of News Breaches SCADA / Cyber, cyber... etc. finishing it off with DERPs/Mailbag (or Deep Dive) And there are weekly Briefs - no arguing or discussion allowed

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

News and Commentary Lessons Learned from the Java Deserialization Bug ( Apache Nose Job that Ben mentioned - everything old is new again) Let's talk a bit about privacy on Tor Baby Monitors live in New York! 2016 Social Security Blogger Award Voting is Open Now Security Firm Norse Corp. Imploding Threat Butt Breaches Let's just assume that there have been some. SCADA / Cyber, cyber... etc The Muricans are invading Canada's all bran fibre (h/t @ultramegaman) Israel got hacked by the NSA and James Bond Go get your prescriptions from these guys Curmudgeon's Corner The latest from Internet Curmudgeons -- tonight Spacerogue - YES THAT SPACEROGUE! DERP Developers Accidentially Ship Dropbox and Gmail Logins - Motorola HSBC succesfully defends against DDoS but is offline Security researcher finds 'backdoor' to MediaTek processors Tavis wrecks Comodo Mailbag

Gentlemen,

First let me say how happy I am that the Liquidmatrix podcast is pushing out new episodes in 2016. I look forward to listening more.

That said I find I must take exception to the "Mailbag" commentary in Episode 61.

<rant>

What definition of "enterprise" are you using?

I will heartily endorse that Matt is an "awesome" hacker and that the toolkit he is building at the startup he's at is likely totally awesome. But in what world is a startup also an enterprise?

Startups use homebrew and open source systems because they are cash-short and it makes more business sense (meaning a combination of financial, risk, compliance, and resource sense) to build versus buy.

But any true enterprise CISO that used a SIEM built by one of their team members is (using the language of the kids today) “smoking crack”.

Why? Allow me to expand the thought.. Assume Matt works for me at an $8B company and I adopted the SIEM platform he developed versus using MSSP or SIEM…

1. As the company grows the amount of time Matt will need to spend building connectors and enhancing the system will continue to grow. Matt will need to take time away from actual security (which is what I hired him for in the first place) and act more like a developer than a security staff member. Is that the best use of his limited time? I doubt it.
2. Some compliance regimes (yeah, I know, I can hear the complaints now but at the enterprise level this stuff matters) require systems you rely on for security to “have support”. I’m not a development shop! I do security for a company that makes widgets! Crap – now I have a finding in my external audit and my PCI assessor is twitching.
3. What happens when Matt gets bored (and he will – all good hackers do after a period of time) and leaves the company? Who’s going to support this thing? Now I have to go find an equally awesome hacker (not an easy prospect these days) and hope they can support this now critical piece of security infrastructure. There is a very real possibility that the system will degrade into a useless piece of crap before I can find someone to take over… That’s potentially devastating as I have *nothing* to fall back on.

Are you seriously asking me to sign up for this amount of risk? REALLY?

</rant>

Homebrew and open source security tools have their place and properly used are likely viable solutions in the startup/SMB space. Use in a true enterprise, IMO, is likely going to add so much risk that the cash expense of $VENDORPRODUCT is very much worth it.

Keep up the good podcast work, y’all. I look forward to more episodes.

Martin Fisher

Briefly -- NO ARGUING OR DISCUSSION ALLOWED Michael Geist on the TPP Internet Link Tester / Validator w/ Raspberry Pi (or any Linux) Maximum Absorbency Garment Bill Clinton has used email once or twice. Nope just twice. Safe Harbour 2 is here Google's Vulnerability Reward Program paid out more than $2 million in 2015 Liquidmatrix Staff Projects -- gratuitous self-promotion Messages from our Sponsors We really need to have more projects Upcoming Appearances:  -- more gratuitous self-promotion Dave: - RSA, ATLSECCON, NAB, Interop, Bill's thong shop James: - Currently nothing till Vegas. Ben: - At home Matt: - RSA? Maybe? Come buy me beer during SXSW Wil: - Waiting to take OSCP... Other LSD Writers: - Apparently bloggering... Closing Thoughts Seacrest Says: Out.

Creative Commons license: BY-NC-SA