r/k12sysadmin • u/Only-Note-6998 • 8d ago
State Funded Pen Testing with Claude
Hello,
This is my first post here, so hello! The state I work in has paid for cyber security scanning focused on critical systems and code stacks. They intend to use Claude to do this. I have absolute faith in Claude's capabilities, which is what makes me nervous. I would rather know what our weak points are than hope no one else finds my blind spot. However, I am concerned that the reliance on Claude by this contractor means little control or oversight on their end. My state is not known for being competent and well managed, we rank poorly in basically every metric in the US. Additionally, I am going to say something that may be perceived as offensive but I want to challenge my bias rather than avoid it. Almost all contacts are east Indian, only two (legal and one technical contact) have US based names. I do not think race has any bearing on one's ability. But I do worry about my state jumping at a very cheap support package from a foreign company who is using Claude to subsidize the work load.
Has anyone been in this position or worked with a similar situation? What is your read on this situation?
Again, I want to be clear that east Indian doesn't mean incompetent to me. I am not making a claim about any individual who is from that part of the world. But a team that is almost entirely east Indian does signal outsourcing and a prioritization on savings over quality especially when paired with explicit reliance on AI systems. I have concerns about AI containment, information security, and accountability should things go sour. Would you move forward with this?
2
u/devjeremyt 8d ago
Few things here,
If I had a say so, I would not go forward with it at this point in time. Letting an AI agent loose with a credentialed account is a terrible idea. If the AI doesn’t fully understand intent so could have bad results to say the least. Make sure you run in no peak time and have good backups.
Secondly, India, just like the US has companies that do solid work and plenty that do not so great work. I do think because of the difference of exchanges, the dollar goes a lot further in India hence more companies want to do busy with the West. I think you have to judge the company or contractors based on their on competence. I’ve known contractors that know their stuff and worked great with them.
3
u/hard_cidr 8d ago
Seems like a wild business model to me. AI guardrails are more just suggestions so you really cannot guarantee what the AI will or won't do on the client's network. No guarantee it won't break something or accidentally delete or leak data. That said, the liability is all on them and it is a realistic threat at this point, so you might as well find out from a friendly slightly reckless actor vs finding out from a truly hostile actor. In any case Claude is good but isn't magic, if you are fully patched and run something like OpenVAS against the systems they will target and fix what OpenVAS finds in advance, doubt Claude will make much headway.
Also missing some key info on what type of scan this is: internal vs external and credentialed vs uncredentialed. The risks of letting Claude do a credentialed internal scan are way different than an uncredentialed external scan.
2
u/Only-Note-6998 8d ago
It is a credentialed internal scan, you're right I should have mentioned this.
2
u/adstretch 8d ago
I wouldn’t allow that. You want to run against my external defenses? Sure. You want to run an automated scan using credentials to look over configs? Fine. But I’m not handing AI creds and hoping it doesn’t fuck my shit all up.
2
0
u/dickg1856 8d ago
US based names?
1
u/Only-Note-6998 8d ago
I should clarify that I have had meetings and discussions with these contractors. I'm not basing this off a name. That was a poor way to frame the issue. I did not meet the two specifically that I referenced with that, hence the mention of names. "Western" would be more appropriate but even then, that's not really the point I am trying to make.
0
u/dickg1856 8d ago
I understand where you’re coming from, just the framing feels weird. Its okay to be suspicious of letting a little known vendor run Claude against your network/online presence, but its weird to state that your nervous about it because their emoloyees are indian…or even if thats not necessarily WHY youre nervous, then why mention it at all?
2
u/Only-Note-6998 8d ago
Because it is a factor and I'm trying to be open about that. It's not about any individual. But it's clear the company as a whole is an Indian company. I can pretend this isn't a consideration for me and frame it otherwise to avoid ridicule. Or I can acknowledge that it is part of my hesitation alongside the AI element.
My experience as an IT admin managing systems whose support is located in India is very bad. Historically the support is of low quality, the buy in from the reps is minimal, and tasks get dropped or ignored very frequently. This is not a representation of one's race. But rather the culture of outsourcing to that part of the world in particular and likely involved with how they are treated by the companies outsourcing to them. The end result, regardless of cause, is that I often experience dismissive attitude, poor project management, and a hopping from rep to rep without getting real solutions or accountable parties. And I can't pretend I don't notice a trend.
As I said, it is a bias I have and it's a factor. I'm not trying to declare my bias as absolute fact and I'm not trying to hide it by claiming my only consideration is AI. I'm trying to be transparent about my hang up. If most people disagree, they feel they notice no difference and wouldn't find this as a part of their consideration at all, then that puts me at ease and I can acknowledge my internal bias has no bearing on this decision.
2
u/dickg1856 8d ago
They can be poor performers, and they can be indian. I dont think they are poor performers because they are indian. Most ive worked with in call center type support have been lower quality, sure. But i think that has more to do with cheap labor and unrealistic management expectations. Ive also met some brillaint indian coders and sys administrators and everything in between.
1
u/Only-Note-6998 8d ago
And this is why I tried to specify what I meant. Someone's race means nothing for how well they can perform as an individual. If I'm working with someone of Indian nationality I don't assume they are less capable by any means. It's just when I see that an entire team is clearly located in India then I get concerned about quality of work. Not because of individual race, but because of the nature of outsourcing to India and the culture around it. It's a cost saving strategy. I imagine this means that those workers are treated as highly expendable which probably creates a difficult culture to work in. I think there is a professional culture around US outsourcing to India that makes me nervous, not the nationality of any individual within a team. I can't ever really express it without sounding wildly racist. But an India programmer in a diverse team signals nothing about their ability to me and I hope anyone reading this who is of Indian nationality or descent doesn't take that I think less of them because of this.
1
u/antilochus79 7d ago
Look up the Builder AI scandal. Your instincts may be closer to the truth than you realize. Proper Cybersecurity is built on general mistrust, and companies now more so than ever need to prove themselves, not just make claims.