{"id":548,"date":"2017-08-11T21:10:45","date_gmt":"2017-08-11T21:10:45","guid":{"rendered":"http:\/\/securitycurve.com\/?p=548"},"modified":"2017-08-11T21:10:45","modified_gmt":"2017-08-11T21:10:45","slug":"directdefense","status":"publish","type":"post","link":"https:\/\/securitycurve.com\/?p=548","title":{"rendered":"DirectDefense: marketing lesson"},"content":{"rendered":"

Have you heard about this thing with DirectDefense<\/a>? \u00a0If not, the short version is that DirectDefense put up a blog post<\/a> alleging that competitor CarbonBlack, among other things, is “…the world\u2019s largest pay-for-play data exfiltration botnet.”<\/p>\n

They say that because they reported that they discovered a “nearly impossible to stop” vulnerability whereby CB would exfiltrate files that it didn’t recognize outside of the organization. \u00a0So that’s a true statement… sort of. \u00a0At least in that CB does sometimes send out files. \u00a0However, it turns out that: 1) it’s an optional, non-default feature, 2) users are warned about it (unambiguously and sternly) when they turn it on, and 3) nobody – either at the customers who were inadvertent case studies for this or at CarbonBlack – was notified about the issue before they read about it in the news.<\/p>\n

CB responded to that\u00a0<\/a>in what I think is a fairly measured and reasonable way via their blog. Essentially, they lay out that it’s a feature, explain why it’s there, and discuss the warnings and stern opprobrium the user receives should they enable it. \u00a0There has been a bit of a subsequent brouhaha about the disclosure side of this: that DD didn’t notify CB ahead of time, that they took liberties with the folks who were case studies, etc. etc. \u00a0I won’t comment on the disclosure issue because I feel like, if anybody was on the fence about why responsible disclosure was a good idea, they can look to this situation to see why. \u00a0Specifically, had DD alerted CB to the posting and given them a chance to review the issue ahead of time, CB would have politely told them “it’s a feature” and saved everybody a lot of pain and headache. \u00a0Not to mention saving DD the “egg on the face” with relatively little downside to them. \u00a0So I feel like rehashing that is covering ground we already knew.<\/p>\n

But there’s another issue here that I think that is maybe also useful. \u00a0The ISMG piece tells us:<\/p>\n

[DirectDefense CEO] Broome acknowledged to me in a phone interview that the blog post was a stretch. He says DirectDefense has been trying to raise attention around data leaks related to the broad sharing of potentially malicious files. But it hadn’t gotten much attention. \u00a0“That didn’t get a lot of play, so we decided to go with a more sensational title,” he says. The blog post is titled “Harvesting Cb Response Data Leaks for Fun and Profit.” When queried further about his company’s assertion that the situation would be “nearly impossible” to fix, Broome says: “Honestly, that would be a bit of sensationalism.”<\/p><\/blockquote>\n

My first response when I read this was to say, “look at the trouble you can get into when execs are fed tone-deaf lines from marketing.” \u00a0Because that happens… No shame in it really – if you’re listening to a CEO talk in depth about threat analysis, chances are good that’s coming from somewhere else. \u00a0Because really, aren’t CEO’s supposed to be out CEO’ing — \u00a0smoking cigars on a yacht or whatever else it is they do — instead of being in the lab analyzing and doing research? \u00a0But then I looked up Jim Broome: prof-services guy at ISS, VP at NT Objectives, Director at Accuvant. \u00a0Which means I’m really not able to tell if this was a marketing gaffe, if he went there on purpose, or if it was something else entirely.<\/p>\n

The upshot is that it’s a useful case study about reigning in marketing hype. \u00a0In the case of DirectDefense, it probably won’t matter that much long term. \u00a0Had they been venture-funded, they might have lost their CEO over this. \u00a0But they’re not (as far as I can tell… they’re private and pretty closed-lipped about how they’re funded). \u00a0But in the meantime, they lost some industry cred. \u00a0And in the very short term, it might be harder to sell the message of (from their mission statement<\/a>), “…delivering customized services with honesty and integrity\u2014every time.”<\/p>\n","protected":false},"excerpt":{"rendered":"

Have you heard about this thing with DirectDefense? \u00a0If not, the short version is that DirectDefense put up a blog post alleging that competitor CarbonBlack, among other things, is “…the world\u2019s largest pay-for-play data exfiltration botnet.” They say that because they reported that they discovered a “nearly impossible to stop” vulnerability whereby CB would exfiltrate […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[4],"tags":[23,40,41],"class_list":["post-548","post","type-post","status-publish","format-standard","hentry","category-security","tag-carbonblack","tag-directdefense","tag-disclosure"],"_links":{"self":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts\/548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=548"}],"version-history":[{"count":0,"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts\/548\/revisions"}],"wp:attachment":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}