<story><title>The Mercenaries: Ex-NSA hackers are shaping the future of cyberwar</title><url>http://www.slate.com/articles/technology/future_tense/2014/11/how_corporations_are_adopting_cyber_defense_and_around_legal_barriers_the.single.html</url><text></text></story><parent_chain></parent_chain><comment><author>tptacek</author><text>Also: the closing grafs in the article, about Cisco&amp;#x27;s acquisition of Sourcefire, are particularly dumb.&lt;p&gt;Sourcefire is the commercial backer of Snort, the open source network intrusion detection system (and also the owners of ClamAV). The author of this article and his sources express surprise that Cisco would pay big money for an open-source product that anyone can use.&lt;p&gt;Cisco paid just about 10x trailing revenue for Sourcefire, a public company that had managed to dominate enterprise network security and which competed directly with products that had been cash cows for Cisco for over a decade. Cisco has for as long as I&amp;#x27;ve been in the industry --- in fact, for as long as there&amp;#x27;s been that industry --- been the single most important acquirer of network security companies. They acquired security companies with the same fervor in 1998 as they do today.&lt;p&gt;Cisco&amp;#x27;s acquisition of Sourcefire might qualify as the single least interesting story in information security in the last 5 years.&lt;p&gt;Want to make a couple hundred million dollars? You too can do what Sourcefire did: start an open source project that appeals to enterprise teams who spend monopoly money to buy products (that is, start any enterprise-relevant open source project). Get thousands of people to use it. Then start a company and hire an inside sales team. Have them call company after company and ask, &amp;quot;Do you use our open-source project?&amp;quot; Sell extra stuff to the people who say &amp;quot;yes&amp;quot;.</text></comment>
<story><title>The Mercenaries: Ex-NSA hackers are shaping the future of cyberwar</title><url>http://www.slate.com/articles/technology/future_tense/2014/11/how_corporations_are_adopting_cyber_defense_and_around_legal_barriers_the.single.html</url><text></text></story><parent_chain></parent_chain><comment><author>tptacek</author><text>&amp;quot;A survey of 181 attendees at the 2012 Black Hat USA conference in Las Vegas found that 36 percent of “information security professionals” said they’d engaged in retaliatory hack-backs.&amp;quot;&lt;p&gt;What? Black Hat attendance is in the high thousands. A plurality of those attending are IT professionals --- people that wouldn&amp;#x27;t have the technical capability to take over a botnet even if they wanted to. Even if you broadened the definition of &amp;quot;hacking back&amp;quot;, as some people do, to recon activities like port scans. No part of this anecdote makes sense.&lt;p&gt;For my part (I&amp;#x27;m a security researcher by background, though that&amp;#x27;s not what I&amp;#x27;m doing now, and I&amp;#x27;ve presented at Black Hat numerous times): not only have I never met a professional who claimed to have &amp;quot;hacked back&amp;quot; anything, but I&amp;#x27;ve never even met one who didn&amp;#x27;t think that was a crazy idea.&lt;p&gt;There is a difference between major organized efforts to bring down botnets and &amp;quot;hackback&amp;quot; the way the term gets associated with Endgame.</text></comment>