Why your enterprise VPN products suck at cybersecurity (their function).

[rickyboone@infosec.exchange]

@GossiTheDog Greed is a powerful drug.

[greatquux@mastodon.social]

@GossiTheDog and THIS is why i just run a public remote desktop server with an IP blocking script and MFA. just one thing to patch!

[williammullins@twit.social]

@GossiTheDog Regrets, but it is not unusual for management to cut costs by firing expensive engineers; and then make further cost-cutting decisions that appear ….

[fuzzyfuzzyfungus@cyberplace.social]

@GossiTheDog I'm not quite sure when the shift occurred; but moving economic incentives toward any% speedruns has really just kept on going badly.

[casandro@f-ckendehoelle.de]

@GossiTheDog I believe there's a misunderstanding. Enterprise VPN products are not made for cybersecurity, they are made to gather money from clients.

I mean they are even transparent about this, calling their products "enterprise grade", which is the English term for "piece of shit you can't get to run without consultants".

Think about the product portfolio of Atlassian, for example.

[byteborg@chaos.social]

@GossiTheDog "Ivanti Dilettanti"?

[brnrd@bsd.network]

@GossiTheDog The whole article is a gem!
https://archive.ph/3tWWI
"Some government officials and private-sector executives are now reconsidering their approach to evaluating cybersecurity software. In addition to excising private equity-owned VPNs from their networks, some factor private equity ownership into their risk assessments of key technologies."

[jfslowik@infosec.exchange]

@GossiTheDog Thank you for sharing this article, aligns perfectly with my experience of private equity in this space. Based on the combo of debt and loss of customers Ivanti’s VPN business appears to be in a death spiral.

[the_moep@mastodon.de]

@brnrd @GossiTheDog As usefull as the site it to pirate news articles you should really not link to archive.[today|is|ph|...] without a huge disclaimer that users visting it will be used for a DDOS attack... https://www.heise.de/en/news/Archive-today-Operator-uses-users-for-DDoS-attack-11171455.html

[christopherkunz@chaos.social]

@brnrd @GossiTheDog This is enterprise enshittification going full circle: Enterprises enshittify enterprise security to secure profits for other enterprises. The epitome of security enshittification. @pluralistic