Skip Navigation
×

- LOG IN
- SIGN UP

Keep Me Logged In

Top Stories
Top Stories

### Trump can't have strong economy and low rates at the same time:...

U.S. President Donald Trump has on several occasions hit out at the Federal Reserve for raising interest rates, claiming that such an action was harmful to the U.S. economy.

Politicsread more

### Analysts say investors should avoid shares of China's Meituan...

Analysts are urging investors to stay away from shares of Chinese tech firm Meituan Dianping, with the company's stock in the doldrums since it listed last September.

Asia Marketsread more

### First-quarter of this year one of the worst despite the global...

Despite the rally in global equity markets, revenues in the first-quarter of 2019 was one of the worst in recent years, CEO of Swiss-bank UBS told CNBC.

Investment Banking and Brokerageread more

### US allies defy Trump administration's plea to ban Huawei from 5G...

Countries including Germany and Thailand have not banned Huawei from their 5G networks despite the U.S. government urging allies to do so.

Technologyread more

### Trump finally got his wish from the Fed, but not for the reasons...

The Fed took a pause on interest rate hikes, which would seem to satisfy President Donald Trump if not for the reasons that are driving the move.

Politicsread more

### Asian shares rise after Fed keeps rates on hold

Shares in Asia mostly rose on Thursday after the U.S. Federal Reserve announced it was keeping interest rates on hold, and indicated that no more rate hikes would be coming in...

Asia Marketsread more

### Go-Pay to 'strengthen' its digital wallet presence in...

To tap the massive potential of Indonesia's electronic payment market, Go-Pay is planning to "strengthen and deepen" its position in that space, according to its CEO Aldi...

Technologyread more

### China's tech-savvy millennials are fueling interest in US stocks

China's young people are increasingly trading U.S. stocks through two apps, both of which are in the process of U.S. IPOs and one of which counts Interactive Brokers as a...

China Marketsread more

### South Korean semiconductor stocks surge on the back of Micron...

Shares of semiconductors companies in South Korea soared during Thursday's trading session after earnings results from U.S. chipmaker Micron bested expectations.

Technologyread more

### Millennial chef makes a living cooking Michelin-style meals from...

Chris Kong has cooked for celebrities such as Guy Savoy, Daniel Humm and, reportedly, Beyonce. But, last year, the 32-year-old quit the glitz and glamour of Michelin-starred...

Make It - Ditching the Corporate Liferead more

### Crash tests slam some popular pickup trucks

New crash tests show pickups with some of the oldest designs could struggle to protect passengers riding in the front seat.

Transportationread more

### Amazon is blocking ads for unprofitable products

Amazon has been more aggressively enforcing its policy of suspending ads if the product being promoted doesn't make money.

Technologyread more
Key Points

- Cybersecurity vendors drive a lot of the news you read about the industry. Here's how that might hurt consumers.
- Vendors emphasize areas of fear where their products are specifically targeted, in the hopes of influencing the greater conversation in corporations about cybersecurity.
- They also use big corporate names or timely news stories to drive their stories into the news cycle, even if the security incident itself is of little value or caused no harm to consumers.

Steven Puetzer | The Image Bank | Getty Images

The cybersecurity vendor marketplace is growing so crowded that some companies have been resorting to extreme tactics to get security executives on the phone to pitch their products, including lying about security emergencies and threatening to expose insignificant breaches to the media.

The aggressive tactics come as the cybersecurity market expands dramatically, with a "long tail" of thousands of vendors with niche specialties. These sales tactics can make it harder for overworked cybersecurity execs to find and stop real threats. It can also result in overhyped publicity about breaches and hacks that are actually minor, which confuses customers and consumers.

CNBC spoke with four top cybersecurity executives at Fortune 500 finance, health care and payments firms about unsavory practices from vendors. These executives all said they have been pressured by vendors and researchers who claimed — rightly or not — to have found a cybersecurity problem at their company. Some hinted at the possibility of negative news coverage if the executive did not listen to the vendor's full pitch.

Complicating the picture, many ethical hackers use their contacts with the company to report legitimate problems. One executive complained the noise makes it difficult to pinpoint the legitimate reports of infrastructure flaws that need to be fixed.

Crying wolf

It's hard for cybersecurity companies to get noticed. Smaller vendors particularly struggle because top corporations already have contracts or strong customer relationships with the biggest companies.

This is where the threat of negative media coverage comes in. Exposing a security flaw, no matter how small, can garner big headlines if it's at a big company. Enough press coverage can spark weeks of outrage and land top leaders in front of Congress.

However, breaches that actually cause damage are relatively rare. As a result, vendors often try to make a big deal out of minor breaches that don't expose important company or customer information.

For instance, all four executives said vendors tried to draw their attention to potentially exposed data on Amazon and Microsoft Azure cloud servers. None of this data included any current material information.

In one case, a database housed business plans for a 10-year-old project that had already been reported on and was now irrelevant. In another case, the data included information about customers — but only their names and the fact that they had attended a technology conference several years earlier. There were no further personally identifying details, Social Security numbers or other data that would have raised the ire of regulators or even senior company executives.

But the representatives pressured the execs on the phone, saying they had repeatedly tried to warn them about these minor issues and were ready to go to media outlets.

Fearing negative publicity, these execs typically agreed to spend around an hour allowing the vendor to offer "free services" to fix the problem, followed by a bigger pitch for paid services.

Two of the executives also said vendors used questionable tactics just to get through to their phone. Vendors have called in to report "emergency" incidents, then once they got past the company's gatekeepers, turned the "alert" into a sales pitch. They have also lied to administrative staff about their reasons for calling, characterizing their call as a matter of grave security importance, only to present a sales pitch once they'd worked their way up to the right executive.

All told, this results in a great deal of wasted time. Worse, as one executive said, "I distrust most of them, so it's possible I miss the people who may be trying to raise actual issues."

'Unless you're the NSA, attribution doesn't matter'

Cybersecurity vendors also often try to scare executives based on the type of perpetrator launching a given attack.

These pitches often work on board members or less technically inclined executives, who are scared of the prospect of defending their networks from Iran, China, North Korea or Russia and impressed at the vendor's purported investigative skills, the executives said.

But for the vast majority of companies, attribution doesn't matter at all, they said. That's because no matter who did it, the vast majority of private-sector data breaches can be attributed to the same basic security weaknesses that all hackers exploit.

"If you're vulnerable to SQL injection," said one bank chief information security officer, referring to a basic type of hack that often is used to steal consumer data, "then you're going to fall prey to SQL injection. It doesn't matter if some kid in the basement does it or the PLA [China's People's Liberation Army]."

Regulators don't particularly care, either, the bank official said. If you have a weakness that you should've fixed, regulators will focus on that weakness.

"Unless you're the NSA, attribution doesn't matter," the security head said.

watch now
Related Tags

- Business
- News Corp Class A
- Booz Allen Hamilton Holding Corp
- Verizon Communications Inc
- Politics

## More In Cybersecurity

watch now
Read More