3 ms·
I've seen this happen way too often at various organizations. My take away is security is a function of the product, not some external process you bolt on top o
by jvehent 10y ago
I've seen this happen way too often at various organizations. My take away is security is a function of the product, not some external process you bolt on top of it.
Organizations typically fail at security because they try to manage it as far away from the product as possible. That leads security and dev/ops teams to manage their goals in isolations: one cares about preventing incident, the other cares about shipping products.
If Agile & DevOps have taught us anything, it's that everyone in the organization should be focused on serving the customer, be it through features, reliable operations, or data security. The only good way to do infosec is to embed security with devs and ops and make everyone shares the goal of making the product better.
- forgottenpass 10y agoI don't think the problem is specialization, just that the incentives mean that the specialization doesn't always get applied where it's needed. Presume a company with the budget to have a SOC, they're doing all the "regular" security jazz and them some. But are they auditing the network services they themselves run, or just applying patches? Auditing the products the company itself is producing, or just kicking the tyres? But they MITM all the outbound https connections, I'm sure that more than makes up for it.