Hacking India's Largest Automaker: Tata Motors

Doh! You are correct! Crossed wires during a meeting

Pay should reward doing something well vs merely doing something. Of course, this would generally mean you need to pay more than the competitor which will happily pay for merely doing something. So yes it is about pay.

I dont think there's much culture when the population is just overloaded with work and traffic and stress

Everyone is saying it’s about pay, but India is a low trust country (so far as large datasets saying as much can be trusted). Anecdotally I have heard the same from my expat friends as well.

I’m not saying pay has no influence, but saying culture has no influence makes no sense. Even if it was all about pay, wealthy Indians choosing to horde their wealth instead of distribute it (caste system, etc) is a cultural root for the pay problem. The two are so intertwined that it’s impossible to claim it’s black and white.

The current western trend of outsourcing and/or importing labor is the real source of this issue. Western businesses care only for profit, so they employ cheap labor. Western culture is currently much more low trust than it was 50 years ago, and trending worse. If anything, I think culture is the more defining factor - pay is downstream of it.

Becuase it is about pay.

For example, most of the security portfolio that GCP provides is developed and product managed out of the Google Hyderabad office, as is a fairly major Israeli CNAPP product that starts with "A", a large CNAPP from a public Israeli-American security company that is directly positioned against Wiz, and a major security vuln mgmt and redteaming tool used by the DoD, GitHub, and Google. But all these employers pay $60k-130k TC for mid-career security professionals in India.

We scoop up anyone who is remotely competent at transnational firms or startups because we can afford to pay Western salaries, and traditional conglomerates in India largely do not care about web exploits unless they are a web platform first and foremost.

Tata Motors - being an automotive company - does not care about web development for the same reason GM doesn't as well: it isn't tangibly connected to revenue generation. As such, they will just contract it out to TCS (a Tata Group company, but both are independent of each other) at the lowest contract rate possible.

It is about pay. If you don’t have someone working on 5 different items continuously straining their bandwidth they tend to do better work.

That culture at WITCH and WITCh adjacent companies is itself a result of the pay.

For our portfolio companies, we are fine paying for quality instead of quantity.

Giving a Rs 60-80 lakh TC offer in BLR or HYD makes it easier to identify and hire good talent, and ik peer security firms (private and public) that are product first are offering similar TC offers in BLR, HYD, and NCR.

On top of that, there has been a reverse brain drain going on since the COVID layoffs in early 2020, so if we want to poach good talent that returned to India from the US, we need to be able to offer Western salaries, otherwise they'd either decide to help their former employer open a GCC or they'd start their own startup.

Realistically, I'd say a $35k-60k TC offer gets you the 50 to 75th percentile in talent in much of India for security, but most product-first companies tend to hire for quality not quantity, and depending on size of FDI and the state, a company can get a $10k-20k per head subsidy which makes it easier to offer higher salaries without impacting our bottom line.

That said, if you are being hired to be a SOC, a generic pentester, or a "detection engineer" you'd be lucky to break the $20k TC mark tbh, but the SOC-to-SWE or Pentester-to-SWE conversions have been our most successful ones because it's easier to build a product for security teams when your engineers were former security practitioners.

That said, the salary pressures for getting good talent in India is high simply because we're competing with Google, Microsoft, Citadel, Nvidia, etc for similar kind of talent within India.

Earning $70k-90k TC in Hyderabad or Bangalore is doable with 10 YoE if you have the right profile (the right jobs, work experience, track record, and luck). Heck, this is why companies like Zscaler have been hiring in Tier 1.5/2 cities like Pune or Chandigarh instead because you can get away with paying $35k-50k TCs for the kind of talent that would demand a $70k-90k TC in BLR or HYD.

I have heard there is a growing trend of hackers paying kickbacks to insiders, certainly makes hacking easier.

When you pay your support employees so little, it's not difficult for someone from a wealthier place to bribe them.

It's perfectly believable. Whether it is more believable or not is a toss up. If you employ such a large number of people there are bound to be a couple of bad apples, and unless you have very good internal processes and monitoring it isn't all that hard to imagine someone doing something they shouldn't be doing. But absent hard evidence that it happened that way it interesting speculation but no more than that, besides, it can be impossible to distinguish between the two even if you have evidence of an inside job that looks like incompetence!

Based on my experience working alongside TCS, incompetence seems far more likely. If we'd asked for a back door, we'd have gotten a solid wall.

Then again, my experience may have left me a little jaded.

> M&S chair, told MPs that hackers had used “sophisticated impersonation” to gain entry “involving a third party.”

20 bucks says this sophisticated impersonation was social engineering a $5/hour outsourced customer support employee

> The attack is expected to lower operating profits by up to £300mn this year.

that's not counting the reputation and brand damage. M&S is seen as a premium retailer and this whole hack made them seem utterly incompetent and unreliable

> had decided to opt for another service provider after the process had completed

i wonder where this other provider is based. i think i'm gonna place another 20 bucks on this.

> The retailer continues to use the Indian group for other services.

lol.

As someone who has been a SWE, PM, and VC in the cybersecurity space and constantly meets with CISOs as well as has formerly been a security practitioner (I should get back to using HackerOne again for fun), I can safely say that the overwhelming majority of security incidents are due to some form of misconfig because development and code review are orthogonal to proactive security checks.

Shift-left was supposed to fix that but it failed because the primary persona to sell ended up becoming the CISO again, and not trying to find a way to make security ownership a Dev and QA responsibility as well (this is largely organizational).

> This has nothing to do with testing.

A good QA can catch/test such security issues although most of such work is given to a dedicated pen tester to find weakness in the platform.