3 ms·
ITT: talking about poor incentives, doing basic threat modeling, etc. The answer has always been professional licensing. And no, just because there's always a
by solatic 10y ago
ITT: talking about poor incentives, doing basic threat modeling, etc.
The answer has always been professional licensing.
And no, just because there's always a new flavor of the month language or framework, doesn't mean the fundamentals change all that often.
* Sanitize inputs
* Secure data at rest and in transit
* Never store secrets in plaintext
* Set up IAM properly for your organization
* Use 2FA whenever possible
* Principle of least access
* Update frequently
Why, again, can't we conditionally license professionals on knowing the basics, and threaten disbarment for knowingly neglecting security?
- lawnchair_larry 10y ago> The answer has always been professional licensing. That's only the answer if you're asking people who have no real experience in security. Those who do are more likely to tell you that will only make the problem worse. Professional licensing for writing or operating software will never work, and if it does, it will be extremely harmful.