Heh, given the title I initially thought SentinelOne was addressing the Chris Krebs situation, and the adversary would be the current administration.
But it's about different nation state actors.
Wow, so if you don't fall in line with the demagoguery, you'll be thrown out, probably to be replaced with someone who does, or it'll be rinse and repeat until that happens.
In Article III, Section 3 of the United States Constitution, treason is specifically limited to levying war against the U.S., or adhering to their enemies, giving them aid and comfort.
Under U.S. Code Title 18, the penalty is death, or not less than five years' imprisonment (with a minimum fine of $10,000, if not sentenced to death). Any person convicted of treason against the United States also forfeits the right to hold public office in the United States.
sublimefire [3 hidden]5 mins ago
It was an interesting read whilst having a cup of coffee. But rather shallow. A couple of mentions of some tools: goreshell, shadowpad, scatterbrain. It might be targeting C-suite folks more than analysts or other security folks. It is more about how you should be slightly afraid to do it on your own and better hire sentinelone to help you.
0xEF [3 hidden]5 mins ago
Now that you mention it, the article does read like curated content. I suppose a piece does not have to be directly selling anything to be an advertisement. Fluff can do just as good a job by simply making readers feel good about a brand.
nonrandomstring [3 hidden]5 mins ago
The essence of the article is a topic of concern, but is expressed
rather lightly in TFA. End runs around security happen at the
edges. From the bottom; by undermining hardware, or code libraries,
supply chains. And we're now seeing "decapitation attacks" right at
the top. Our "western" security models have a weakness, with their
roots in Prussian military organisation and bureaucratic technical
management, by default they trust up. The whole DOGE caper (what I
would call a Dr Strangelove scenario - variation of insider-threat)
exposes this as actually very vulnerable.
Cybersecurity services that operate as MSPs (the acronym variation
where S is for security) hit a fundamental problem. A managed security
provider becomes a bigger and juicer target since all of its clients
are implied spoils. If they in turn defer-to/buy-from bigger actors up
the food chain, those become juicer targets too.
This a frequent chestnut when we interview cybsersecurity company
CEOs. Although it resurfaces the old "Who guards the guardians?",
there is more to it. One has to actively avoid concentrating too much
"power" (non-ironically a synonym of vulnerability ... heavy lies
the crown) in one place, but to distribute risk by distributing
responsibility for building trust relations (TFA mentions this). I
expect we'll see more and more of this sort of thinking as events
unfold.
shihabkhanbd [3 hidden]5 mins ago
I'd take the SANS top 20 security controls and figure out where I'm at, then create a plan to close the biggest gaps.
PeterStuer [3 hidden]5 mins ago
I tuned in late to this show. Are they down to tHe DPRK because they already successfully rooted out the MOSSAD, CIA and NSA insiders in previous episodes?
Cthulhu_ [3 hidden]5 mins ago
It's an American based company, they still assume those parties are on their side.
a3w [3 hidden]5 mins ago
Or at least powerful enough to just march in with a court order, taking the company onto the side of them at a whim.
CyberMacGyver [3 hidden]5 mins ago
It’s RSA time so expect lot of cybersecurity posts
saagarjha [3 hidden]5 mins ago
Ah, that’s why all the people in business attire are swarming around
owyn [3 hidden]5 mins ago
I haven't heard of that one. What is RSA time?
mandevil [3 hidden]5 mins ago
2025 RSA Conference USA in San Francisco. So lots of papers are going to be presented and talks given on new clever ways researchers have figured out to beat different layers of security, tracking APT's, etc.
That's kinda cruel. RSA is trying to do a good job, and takes their customers safety quite seriously.
(Kidding. A little.)
imiric [3 hidden]5 mins ago
I hope you're entirely kidding with that statement.
RSA was famously bribed by the NSA to make their compromised PRNG the default in their cryptography library, which shipped from 2004 to 2013. Any credibility they might've had vanished after that was publicized in the Snowden leaks.
ash-ali [3 hidden]5 mins ago
RSA conference in the city
looperhacks [3 hidden]5 mins ago
Is there any way to recognize adversary IT workers? Not many companies have the capabilities of cybersecurity experts
recursivecaveat [3 hidden]5 mins ago
Biggest thing you can do is just ensure you conduct at least 1 on-site interview, and make sure that interviewer is in a position to realize if the person they met is not the same one who shows up for other interviews and/or the work. Cost of a flight is nothing really compared to recruiting and hiring (and if you really are fully-remote and geographically distributed, you probably already have somebody in their metro area), on-sites used to be standard.
khafra [3 hidden]5 mins ago
I mean, it's not the biggest thing you can do; you could start selling to the government, become a cleared contractor, and then you could require a USG security clearance for job applicants.
I would call the on-site interview and/or minimal background check "the most pareto frontier thing you can do."
Mountain_Skies [3 hidden]5 mins ago
How much of that would you get from just using e-verify? That doesn't find criminal issues like a security clearance does but seems like it would at least reduce the pool of nefarious applicants by a significant margin.
I run outsourcing agency, we work with US clients and have seen lots of fake applications (different degree of sophistication), so far we have either rejected them right away, or we were able to filter them during (remote) interviews.
bigfatkitten [3 hidden]5 mins ago
Just make them show up in person at least once for onboarding. They're not going to fly out from China or Russia (where they tend to be based) to do this; especially not to the US.
Verify their ID in person, issue their laptop etc in person, make sure someone who interviewed them is there to meet and greet them (and attest that it's the same person they talked to.)
If you can at least do a final interview in person also, then that's even better.
Cthulhu_ [3 hidden]5 mins ago
Definitely the 'regular' application procedures - check someone's ID, check their references, ideally meet them face to face, etc.
This is more tricky with remote-only jobs or worse, "gigs" where you don't even meet people. But also, I would've expected open source to be "infiltrated" a lot more than it has, since that's very much anonymous internet culture... but also a culture of code reviews and the like.
CyberMacGyver [3 hidden]5 mins ago
Yes there are lot of identifiers. They are improving a lot, so things are changing daily. There are certain steps to take pre hiring and post hiring. If you need help share your email and I can provide details.
smolder [3 hidden]5 mins ago
The reality is a bunch of people trying to secure their insurance relationship. Useless money absorbers are running things.
Animats [3 hidden]5 mins ago
Start with a fingerprint check before you even talk to them.[1] Then ask for a REAL ID at the interview, take fingerprints again, and match with the ones from the pre-screen fingerprint check. You need to be signed up with a driver's license verification service to validate the ID.[2]
It takes that level of verification to become a security guard or a school bus driver. Anybody in computer security should be doing this.
I live in China, a supposedly autocratic country and one with universal ID, and even companies here don't take fingerprints. ID will be shown when you are officially onboard. I can't say for all, but for most companies (at least the ones without the need for a security clearance), requiring ID at interview will be seen as a red flag, and requiring fingerprint would probably be put on social media and name shamed, if not straight up reported to the authorities.
mixmastamyk [3 hidden]5 mins ago
Not a typical job but one in a high security environment, seems somewhat understandable.
Not that I’d do it. The paradox that security for a firm means zero privacy for me is too much to bear these days.
Cthulhu_ [3 hidden]5 mins ago
In a high security environment, you can get a report from law enforcement; in the Netherlands this is called a "declaration around behaviour" (??), which is basically a signed / authenticated document saying "this person was not involved in financial crimes" - you need to have it specified for a category of crimes, the previous is for example one I had to get to work at a bank as a contractor.
I'd trust an FBI report more than taking their fingerprints and the like.
Gathering6678 [3 hidden]5 mins ago
I have some experience working for financial institutions with access to highly confidential information, and haven't been required to produce my fingerprint for, like, ever.
Again, I can't say for all, and I'm sure there are certain companies and positions which require such measures, but I could not imagine requiring fingerprints (or even ID during interview) to be acceptable in most cases.
mikewarot [3 hidden]5 mins ago
You just can't secure something like Windows, Linux, MacOS, because it's faulty by design. Any business that claims to be able to do so is selling snake oil.
Capability based operating systems can be made secure. Data diodes are a proven strategy to allow remote monitoring without the possibility of ingress of control. Between those two tools, you have a chance of useable and secure computing in the modern age, even against advanced threats.
Yeah... I feel like Cassandra, but here we are. You've been warned, yet again.
Cthulhu_ [3 hidden]5 mins ago
What OSes are you proposing though? You're positing a problem and warning people, but what are the alternative operating systems that implement these data diodes?
mdhb [3 hidden]5 mins ago
Google’s in development (contrary to what people on here will tell you) new operating system Fuchsia actually has what seems to be a genuinely defendable architecture.
I expect it to be ready long after GNU/Hurd will be the default system installed on new machines being sold.
sublimefire [3 hidden]5 mins ago
hmm but this is not really about it, it is more about how companies can be protected. It talks e.g. about shadow IT workers trying to infiltrate into the company.
hulitu [3 hidden]5 mins ago
> Recent adversaries have included:
DPRK IT workers posing as job applicants
ransomware operators probing for ways to access/abuse our platform
Chinese state-sponsored actors targeting organizations aligned with our business and customer base
Thank god there were no Russians or Iranians. /s
bigfatkitten [3 hidden]5 mins ago
Iranians have been doing it too, on an individual, sanctions-evading level rather than as a state-sponsored mission.
Many of the DPRK workers operate out of Russia (and China.)
HN.zip
(context: https://www.cnbc.com/2025/04/16/former-cisa-chief-krebs-leav... )
Under U.S. Code Title 18, the penalty is death, or not less than five years' imprisonment (with a minimum fine of $10,000, if not sentenced to death). Any person convicted of treason against the United States also forfeits the right to hold public office in the United States.
Cybersecurity services that operate as MSPs (the acronym variation where S is for security) hit a fundamental problem. A managed security provider becomes a bigger and juicer target since all of its clients are implied spoils. If they in turn defer-to/buy-from bigger actors up the food chain, those become juicer targets too.
This a frequent chestnut when we interview cybsersecurity company CEOs. Although it resurfaces the old "Who guards the guardians?", there is more to it. One has to actively avoid concentrating too much "power" (non-ironically a synonym of vulnerability ... heavy lies the crown) in one place, but to distribute risk by distributing responsibility for building trust relations (TFA mentions this). I expect we'll see more and more of this sort of thinking as events unfold.
https://www.rsaconference.com/usa
(Kidding. A little.)
RSA was famously bribed by the NSA to make their compromised PRNG the default in their cryptography library, which shipped from 2004 to 2013. Any credibility they might've had vanished after that was publicized in the Snowden leaks.
I would call the on-site interview and/or minimal background check "the most pareto frontier thing you can do."
I run outsourcing agency, we work with US clients and have seen lots of fake applications (different degree of sophistication), so far we have either rejected them right away, or we were able to filter them during (remote) interviews.
Verify their ID in person, issue their laptop etc in person, make sure someone who interviewed them is there to meet and greet them (and attest that it's the same person they talked to.)
If you can at least do a final interview in person also, then that's even better.
This is more tricky with remote-only jobs or worse, "gigs" where you don't even meet people. But also, I would've expected open source to be "infiltrated" a lot more than it has, since that's very much anonymous internet culture... but also a culture of code reviews and the like.
It takes that level of verification to become a security guard or a school bus driver. Anybody in computer security should be doing this.
[1] https://www.sterlingcheck.com/services/fingerprinting/
[2] https://www.aamva.org/technology/systems/verification-system...
I live in China, a supposedly autocratic country and one with universal ID, and even companies here don't take fingerprints. ID will be shown when you are officially onboard. I can't say for all, but for most companies (at least the ones without the need for a security clearance), requiring ID at interview will be seen as a red flag, and requiring fingerprint would probably be put on social media and name shamed, if not straight up reported to the authorities.
Not that I’d do it. The paradox that security for a firm means zero privacy for me is too much to bear these days.
I don't know what the equivalent in the US is, but https://www.fbi.gov/how-we-can-help-you/more-fbi-services-an... seems similar enough.
I'd trust an FBI report more than taking their fingerprints and the like.
Again, I can't say for all, and I'm sure there are certain companies and positions which require such measures, but I could not imagine requiring fingerprints (or even ID during interview) to be acceptable in most cases.
Capability based operating systems can be made secure. Data diodes are a proven strategy to allow remote monitoring without the possibility of ingress of control. Between those two tools, you have a chance of useable and secure computing in the modern age, even against advanced threats.
Yeah... I feel like Cassandra, but here we are. You've been warned, yet again.
https://fuchsia.dev/fuchsia-src/concepts/principles/secure
Thank god there were no Russians or Iranians. /s
Many of the DPRK workers operate out of Russia (and China.)