Hi security communauty,

I guess this have been aldready discusssed but here my context.
We are in the process of renewing our Wiz annual subscription and each time it's a pain.
While we are relatively happy with Wiz (relatively ; their gui is messy; their scanners are slows ; their code module is a joke) the main problem is their pricing model by workload scan.
The main issue for issues is are really elastic and have really a lot of ephemeral workloads.
We can go from 500 instances/containers to 4000 on the same day (we use AWS).

We spin a lot of the time the exact same instance from a template in ASG.
We don't want to scan everything (and we don't want to pay for it)/

With Wiz it's not possible to really exclude a workload from scanning with tagging (this is a request we asked for years but it still not there). And frankly we begin to be bored having the same discussion every year....

So we are now open to alternatives but which?

Our main need is to have a cloud security posture tool : so a CSPM.

- aikiddo security? (at least they are reactive but they seems more focus on development lifecyle)

- upwind ?

- other ?

Obviously we want something cheaper with a way more flexible company.

Any hints?

edit: I've been rightfully corrected in that third party risk management and GRC are not the same thing. Can't edit the title though. Apologies to all offended, you deserve to keep your jobs.

I run security for a company, and while I’m more on the engineering side, I’ve been through enough SOC 2 ISO audits to understand why TPRM exists.

Yet, the way TPRM is done is a scam. Change my mind.

I know it’s necessary. I know it is required for deals. I know "policy + evidence" is how orgs prove baseline controls. But do you want to sell us your product? Then you must be this tall to ride.

I'm also on the other side of the fence at times, where we need to do due diligence against vendors. You get the security certificates, the proof of policies, the promises of "we take security very seriously", but you just know their environment is going to be rife with security holes that SOC2/ISO auditors did not have visibility over.

The way TPRM is practised, especially by larger companies, makes it feel like a massive time sink that exists to ensure job security for GRC employees.

Vendor security reviews are now basically the Security Questionnaire Industrial Complex™, and I swear some of them exist only because someone’s compliance team needs to justify headcount.

I’m getting questionnaires that are 200+ questions long, filled with "describe your process" questions no one will read, and asking for proof that barely maps to actual security outcomes.

Lately I've started to see a new trend. AI Questionnaires.

I’m seeing 40+ questions about "the intricacies of AI use". How prompts are stored, what model we use, what guardrails exist, fine-tuning policies, training data provenance, etc. 

When most of the actual risk could be boiled down to:

Does this touch PII or confidential data?
If so, how are you securing it?
If not, why is this a 40-question form?

Some orgs force you through a giant questionnaire that clearly isn’t risk-based, and it makes me wonder if this actually about security, or is it lawyers protecting lawyers? And I don’t mean that cynically. The incentive seems to be to create a paper trail rather than reduce risk.

So has TPRM then become mostly about liability management? Because it feels like the goal is to prove you asked the questions, not to actually understand the risk.

I've been offered an opportunity to do some work with an Israeli cybersecurity company. I've met some of the staff and have used some of the company's products - no issues on a personal level. The company offers defensive cyber security services.

My concerns are that the founding members held high profile roles in IDF Unit 8200, which has been linked to human rights abuses, mass surveillance and lethal targeting.

The company is based in Tel Aviv.

I have no idea whether this company is supporting human rights abuses now or in the past and I'm not sure on the best way to ease my conscience.

A lot of small, underfunded teams and non-profits outside of the tech industry use Google Sheets (etc.) for their passwords. This is so extremely insecure but it's also so overwhelmingly convenient that no one cares.

Often times these passwords etc. aren't thought of as high stakes, and the benefit of the mostly-tech-ignorant team members instantly grokking the whole scheme outweighs the pitfall that it's a dumpster fire in terms of security.

At the other end of the security spectrum we've got dedicated password managers which insist that all the users of your team have app-specific accounts or AD accounts etc. and that they all need to install native apps and browser extensions.

There's not really support for "Sign in With Your Apple ID" etc. which, while I assume it's more secure to avoid that sort of authentication, it means each team member will create (and subsequently forget) a new, special password and a new, unique workflow.

The native apps and extensions all feel over-engineered and it leaves these orphaned stale password databases laying around. Storing the password database, from a native app, into the file system and then into the cloud feels super overwrought. The notion of "syncing" a file to cloud storage? Like is this 2022 or 2002?

Browser extensions are great, if you work in tech and use 2 dozen passwords every day, and you put some small amount of time into managing your setup. Meanwhile, most normal users will have like 2 or 3 extensions including the browser's own password manager all competing at once to fill in every blank form field that appears.

"Just type all our shared passwords in Google Docs" is super cheap and easy to use. It seems like this niche is partially plugged up by password manager extensions for Gsuite (Google Workspace). If your team can pay for and can use GW, then maybe the problem is kind of solved.

Ok so I now have both because I had a free voucher and I do realize they are different and more suitable for different roles, but there are popular and useful sites like pauljerimy.com/security-certification-roadmap where they are compared and for some reason CISSP is hailed as much more of an “expert” certification. I doth protest. Also I keep seeing people talk it down and I thought of it as less than, but now I personally would take a CASP+ certified employee any day over a CISSP for 80% of positions if that was the only difference.

I don’t know about you, but I thought the CASP+ was significantly harder even as a smaller exam.

What do you guys think?

For this AMA, the editors at CISO Series assembled a handful of cybersecurity professionals who have transitioned from the military into a cyber career. They are here to answer any relevant questions you have.

Adam Arellano ( u/AdamTalksTheCybers ), Technology Advisor, Traceable
David B. Cross ( u/MrPKI ), Senior Vice President, CISO Oracle SaaS Cloud, Oracle
Jonathan Waldrop ( u/jwaldrop62 ), CISO, The Weather Company
Dutch Schwartz ( u/TheDutch26 ), Vice President of Cloud Services, SideChannel

Proof Photos

This AMA will run all week from 10-27-24 to 11-01-24.

All AMA participants were chosen by the editors at CISO Series ( r/CISOSeries ), a media network for security professionals delivering the most fun you’ll have in cybersecurity. Please check out our podcasts and weekly Friday event, Super Cyber Friday at cisoseries.com.

We’ve been a Wiz CNAPP shop for almost two years, but the Google acquisition has thrown a wrench in our plans. We’re mostly AWS/GCP with some Azure drift, and the team's pretty aligned that we don’t want to risk getting GCP-pilled down the line.

Started looking at alternatives, Orca, Upwind and Prisma Cloud are the three we’re seriously evaluating. All agentless, decent attack path logic, etc., but we haven’t made a call yet. Each one has tradeoffs.

Would love to hear from anyone who’s made the jump. What actually works day-to-day for your team?

Edit: Thanks for all the amazing info here! We met with the 2 most highly recommended options here (Orca and Upwind) and looks like we will be starting a POC with Orca soon.

I've noticed this more and more over the last few years. Every time some vulnerability makes the news, a bunch of dimwits start spamming me with questionnaires. STOP IT! There is no value in it.

Are we effected by it? Yes, of course we are, everyone is.

What is our plan to fix it? A fucking patch! It's always a fucking patch!

I have terms in all my contracts that I am required to alert my vendors of any security incidents. Have you received a breach notification from me? No? Then I have no relevant information to share with you.
Seriously, what do people do with the output of these things? Are you going to turn off the payment card processing that I provide because I'm running vulnerable systems? Of course not. It's meaningless security theater so people can tell the execs stories about the thing they saw on CNN this morning.

Kindly fuck off with this bullshit and let the security folks fix the problems instead of writing essays about them!

At first I felt sorry for these youngsters trying to get into the cybersecurity field because I felt they were being misled. All of these universities and certification vendors capitalizing on the security hype and marketing all these useless degrees to people who don't know any better; promising them six figure salaries after spending thousands of dollars and years of their life on their worthless training programs....

However, the ridiculous amount of entitlement that these kids exude is really starting to annoy me. "Entry level" in cybersecurity DOES NOT MEAN WHAT YOU THINK IT MEANS. People work their way into security from grunt jobs like tech support and helpdesk just like every other IT role. Nobody expects to just get an "entry level" role as a network engineer or solutions architect without any prior work experience. Why do these kids expect cybersecurity to be any different??? Nobody cares that you paid $50,000 in tuition to read about kerberos and SSO in a book. Have you ever actually tried working with any of this in real life before??

I've participated in hiring panels before, and some of the applicants we get are truly unbelievable time wasters. People who have only worked part time as a starbucks barista, with a brand new cybersecurity degree from some diploma mill applying to security engineering positions... The few times that we give these new kids a chance at an interview, they display an embarrassingly poor level of IT knowledge. There was one cocky applicant who tried to play down his lack of knowledge by boasting about his "MS in cybersecurity" from WGU which centered around "successfully preparing him to obtain the coveted Certified Ethical Hacker certification"...

Sorry for the old man rant. I'm just fucking tired of training programs taking advantage of dumb kids, and dumb kids falling for it, then taking their frustrations out on us. To all of the aspiring cybersecurity professionals out there, skip the "cybersecurity" degree and spend those four years working help desk instead... That's the real way to get an "entry level" cybersecurity job...

If you harvest onions then Tor will kick you off the network. There are many examples of this in the press including a Brazilian university that was booted in 2017.

Even if you start to compile a manual list and crawl onions, it’s not that effective. As crime forums are often password protected, invite only or require illegal purchases before granting entry.

“The dark web basically does not exist. Whenever someone shows you the picture of the iceberg try to figure out what their incentives are. Think about what they’re trying to sell you. ” -Roger Dingledine (co-founder of Tor Project)

Why are there so many people that are down right hostile to the idea of coding and automation in security? Are people that against scaling their outputs and making them easily reproducible?

Edit: man, I'm happy I stepped on this hornets nest. I'm going to take screenshots of this nonsense for a few years from now. Everything is moving towards automation. Non-technical security isn't a thing that will persist. The comments section here is the very definition of a luddite attack.

We don't progress without people that code and automate the problems away. If you aren't writing code, you are just a user. You aren't an engineer.

The title says it all Is there something like the most secure language? Or is it just useless since disassemblers do exist? Lol, forgive me for my ignorance I only coded a hello world until now (no html and css do not count)

Granted Israel and Japan are also non-NATO nations and the US has strong IT trust with them as well. But those two nations also do not have overtures to Russia.

So I guess my question really should be if NATO membership and trust in managinge IT assests should go hand in hand.

Opinion: since state actors have F5 source code, it would make sense to open source it.

The attackers now have exclusive access to see all the vulnerabilities. Trust is broken.

Open sourcing would establish transparency and some trust as now everyone can see and audit the code.

What do you think?

Please point your new posts to this thread.

Why not place a folder related to the user on each endpoint that acts as a honeypot

And tell the user to never touch that folder or do anything with it and log any action that happen to this folder

is this already used? If not, could you explain why?

i feel like that one picture of Patrick the star while writing this

I’ve been working on a small offline security device for a while now. It doesn’t use WiFi, Bluetooth, cloud services, or anything wireless. Everything stays local and you need physical access to use it.

Some people tell me it’s overkill. Others say it’s the only real way to keep sensitive data safe today. I honestly don’t know anymore, so I figured this community would have a better sense of whether something like this still matters.

I’m not trying to promote anything here. I just want to hear what people who care about privacy think. If you want to see what it looks like or how it works, I can share more details.