Possible case, furthered tempered by "infosec industry source". :) It is their job to sell fear

The entire "infosec industry" is fraudulent, in my estimation. A bunch of assholes selling powerpoints and not a whole lot else. I've seen it a lot.

None of them know what they're talking about. Source: my direct experience

I wouldn't say that, but they do suffer from something the IT industry as a whole suffers from: there is/was a need, and by fulfilling that need, they find themselves in a quandary where they're committed to something that must continue to exist in order to avoid inflicting self-harm.

You can't go into business selling software on the assumption you'll sell a single copy and your work is finished. Infosec is no different. There is always this paradoxical need to ensure you never become entirely redundant, regardless of the function you specialize in

I think a lot of the great "evolutionary difficulties" in our industry can be phrased this way. It's why things like Microsoft Excel are laughed at even as hundreds of thousands are trained in the art of constructing effectively bespoke spreadsheets apps in Django by the million every year. I hope for a correction some day, just as much as I hope I'm on the right side of it when it comes..

You misunderstand. "Infosec" is a shopping list item on govt requirements. "We need this, this, this, and it needs to be secure!" They assume security is just this additional ingredient that can be purchased, mixed in, and boom; project is secure, like mixing in chili to anything will make it hot. The infosec companies do everything they can to encourage this assumption.

It's all bullshit, and these people are pure scum.

Speaking as a developer, I've had my ass handed to me by competent security folk on several occasions. Unfortunately in the software industry, security must regularly be an additional ingredient that can be purchased and mixed in, because 98% of us are completely clueless and absolutely not thinking about this stuff as we're trying to clear a sprint board

Serious questions:

> because 98% of us are completely clueless

Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious.

I suspect there could be a startup idea here somewhere.

> absolutely not thinking about this stuff as we're trying to clear a sprint board

Does anyone have a decent tool/process for remembering all of the detailed tasks for every type of software deliverable? I find myself in a state of cognitive coma after sprint planning when I need to divide tasks into subtasks.

> Do universities/bootcamps teach OWASP-style classes of programming vulnerabilities these days? Some developers are curious enough to learn them on their own, but many are oblivious.

I had exactly one course that touched on security.

A course in web programming.

The instruction we received consisted of: "If your project is not secure, it will lose points."

I'm not sure a single person on that class had one point taken off for getting security wrong.

Why would a university care about educating people in something ephemeral, and domain-specific, like security, when it could instead be teaching them about complexity theory and Djikstra, and third normal form?

I refuse to learn about infosec, for the same reason that I refuse to become an amateur surgeon: I don't want to know enough to be dangerous. This is a field that will take 100% of your time if you want to be good at it, and being "meh" is more dangerous than realizing you don't know anything and paying an expert.

(Crypto and security in general were a hobby of mine until I realized how difficult the field really is. "Programming Satan's computer" was one paper that contributed to that.)

You are utterly wrong.

The real problem is that there is a vast need for professionals and the lack of them calls a lot of smoke-sellers. And for a lot of people is hard to tell wether they are legit.

Just look at the Machine Learning / Artificial Intelligence industry. Also "fraudulent" if you apply the same logic.

Oh, I don't think I'm wrong. And neither do you, since your second sentence basically agrees with me. Hit a nerve?

And yeah, most of the ML industry is in precisely the same category. A bunch of frauds.

I can see your point, but babblers != industry.

Sounds like your idea of infosec is colored by a bunch of salespeople.

You'd be surprised just how many places run public unpatched stuff with admin/root holes here and there. Ive seen passwords like "123456" and "password" and plenty other badness that nobody really bats an eye to.

And even simple things like "Use WPA2 and a password manager", for low barrier infosec is routinely ignored. Companies can barely even manage that.... and they have the funds.

And it's not like the bad stuff is scare quotes. Ransomware is a thing. Ive seen a hospital network up north get hit by it. City of Madison IN (1h away from me) ended up paying a large sum, cause they thought backups were pointless. Even know of a story where a state government's machine ended up being a warez server. The lead though to clean up a trojaned linux box, was to rsync from a clean one. Left most of the trojan kmods intact. I caught it down the line.

Sure, if the likes you're talking about is complaints about IBM with QScan or similar, with grandiose claims that their software will save everything - thats obvious bullshit. Security is definitely a process and procedures, ALONG WITH technical means to facilitate that. Even automated scanning of "front doors", or doing routine searches in Shodan is a magnitude better than nothing.

Nice anecdote. There's a shitload of salesmen selling snake oil in security, but they're mostly selling it to idiots and people who think security is a box you tick and not a continual process.

In your direct experience, have you never come across any non trivial security vulnerabilities?

For the newspaper, a 'deep fake' story sells better.

For the executive who messed up, by using the 'deep fake' story, they become blameless. If they admit to a voice actor, they can be questioned for incompetence.

Everyone wins, except those who care about the truth.

The whole thing reminds me of: "The majority of men prefer delusion to truth. It soothes. It is easy to grasp. Above all, it fits more snugly than the truth into a universe of false appearances—of complex and irrational phenomena,” ― Friedrich Nietzsche, The Antichrist

>For the executive who messed up, by using the 'deep fake' story, they become blameless. If they admit to a voice actor, they can be questioned for incompetence

I don't really see why the two should be considered any different.

Because of one of Clarke's laws:

> Any sufficiently advanced technology is indistinguishable from magic.

The mostly tech illiterate boses and the unthinking masses can't really parse the deep fake story. For most, there's simply no basis of comparison even they wanted to expend the energy on system 2 thinking.

But talk about voice actors and everyone knows someone who does imitations. So they will base their anecdotal experiences in judging the possibility of what happened. This also mostly comes from system 1 thinking, which is pleasant to do, since it removes uncertainty from the world.

Edit: when thinking of deep fakes, it applies to me too. I don't know how advanced they CAN be. I'm sure some military has some amazing ones that aren't open to the public. It's a point that goes beyond my imagination and into a world of uncertainty.

So a fake deepfake - not sure where this is going to end.

Crud, I would have totally blindly trusted Sophos on this.

Don't trust obviously incentivized players like Sophos, karma-chasing security wannabes, or anyone else in this category around this kind of topic. German media is very good. Spiegel is an excellent paper.

Trust your instincts, look for second sources, and wait to follow up before you decide one way or the other.

Sounds like what I always considered "crazy talk" but you're right. Don't always assume and trust. Thanks