Cybersecurity and Risk: Why Business Is Killing the Community

A few days ago I came across a LinkedIn post from a Chilean security professional. Taking advantage of Children’s Day, he had put up a photo of himself at 8 years old using a computer for the first time, with a huge look of joy on his face. In the post, he mentioned that this same look of excitement and curiosity in front of that “unknown gadget” is the same look a lot of us security professionals, the ones now in our 40s or older, had back when we were starting out.

And it’s true. I personally got into infosec long before I even knew there was a market for it, or that universities offered specializations or related subjects. It was all community: virtual or in-person groups of people getting together to learn, hack, get into trouble, and experiment, simply because we wanted to. And out of all that, what felt most important was sharing. Finding vulnerability, building a personal project or a script, and sharing it among friends so others could see it, improve it, and review it.

Today, all of that has changed, and there’s a multibillion-dollar market built on top of it. But sadly, it seems that the motivation of doing things just because you enjoy them is shrinking.

Back in 2021, Carnegie Mellon already gave us a hint of this when they sent out a notice to all the CERTs they had certified around the world, announcing that they were ending their international presence and scaling back to CERTs in the United States only. The reason, which I fully share, is that they no longer saw the value in having teams around the world when those teams weren’t collaborating with each other. What they were seeing was that the CERT logo was being used purely for commercial purposes, with no real contribution to improvement or research.

Mexico is no exception. In 2018, after the SPEI incident, which I happened to be part of as an investigator, a bunch of companies immediately popped up and formed a closed group to share relevant information about incidents. None of the companies that formed it had been involved in the incident, and getting into that group to share information was impossible: it was closed off to their own business partners. Examples like this keep coming: associations, research groups, regional chapters, whose only purpose is to leverage their affiliations commercially.

That’s not necessarily a bad thing in itself; it’s a differentiator. However, not living up to the purpose those groups were originally created for is what stops them from adding any real value.

In early April, here in Mexico, several outlets reported that a security service provider had suffered a security incident in which their clients’ data was being sold on an internet forum. And toward the end of April, news also broke about another company in the same line of business that had been hit with an incident.

The details aren’t fully known; the first company admitted being a victim of the incident, and the second one denied it. We’re not going to focus on that, but on the reactions.

Within hours of the incident, different executives started posting, even directly replying to the official statements, questioning the practices, processes, technologies, or capabilities of the affected companies. Some are openly tagged and invited the clients’ executives, offering them free consulting to prove the weaknesses tied to having hired those providers. The mockery coming from official company accounts, accounts that should be careful about how they talk about competitors and other professionals, was aggressive, baseless, and always pointing at the same thing: “They don’t know what they’re doing, we do; swap them out for us.”

Any infosec professional knows that risk can never be zero. There will always be a residual risk that, no matter how many controls, investments, technology, or capabilities you have, simply can’t be eliminated. It’s a fundamental concept we all know. And yet, in their aggressive posts, these companies were guaranteeing a complete reduction of risk compared to the affected companies.

If the goal is to throw ourselves like sharks into a sea of blood, then what’s the point of what we do? Where do all those associations promoting alliances for information sharing fit in? What about the events trying to bring government, industry, and universities together to develop capabilities, push security legislation, or work on joint projects, if in practice all anyone is doing is hunting for their neighbor’s mistake to step over them?

Personally, I’ve experienced this in my current role and in past ones, both at the organizational and personal level. But there’s another way to look for business growth that doesn’t involve spreading misinformation, lying, or riding the wave of news headlines, and that’s actually building alliances based on mutual benefit.

This may come across as a very personal opinion, but the company I currently work for got started precisely because a competitor asked its different partners if they’d be interested in running outsourced projects that weren’t profitable for them. Even though both companies could look like competitors, the relationship was natural and, to this day, extremely beneficial for both. And we’re not the only ones. There are plenty of companies that build these kinds of alliances for a shared purpose and mutual benefit.

What’s interesting is that these benefits don’t stay only at the business level. The interaction between teams with different visions, complementary technical skills, different technologies, and different budgets creates business collaborations that, at the technical level, end up producing much more solid projects and results that, in the end, deliver greater benefit to clients.

And the most important thing: no logo, no title, no badge in the middle holding those alliances together, just that same motivation that brought us together in the beginning: curiosity.

Not everything is heading in the wrong direction. These days, now that universities have included security as part of their courses or specializations, groups of students have started showing up looking to exchange information, take part in CTFs, build communities, organize school events, attend conferences to learn, compete, and share with other university groups, growing together.

Women’s associations are looking for scholarships, training, and spaces to give talks and run workshops, working to have greater representation in the industry without having to step over anyone else.

Researchers and professionals keep publishing their projects under open-source licenses; villages, which at the end of the day are just groups of people who happen to be into a specific topic, keep talking about projects, creating challenges, and giving up some of their free time to generate knowledge.

Not everything is bad, but we’re at a point where we have to decide whether what moves us is just a financial interest in what we spend at least eight hours a day doing, or whether we still have inside us that kid who formatted his hard drive trying to install his first Linux distro and ended up with no computer at 8 years old.