5 ms·

Australian security and the cult of mediocrity

44 points by Khaine 9y ago

aryehof 9y ago
> “The truth is, programmers are hasty,” he said. “They under document, they under analyse, they under think, they under test, and Agile software development just gives them license to cut corners." Agile development has a lot to answer for. It's sadly been largely elevated to a religion which excludes innovation and thought about improvement.
microcolonel 9y ago
PSA regarding scrolljacking: please, not even once, please. Here is an archive link so you don't need to suffer it: http://archive.is/0ELqt http://archive.is/0ELqt
sytringy05 9y ago
This article is generalised rubbish. That's not to say there's a shortage of badly managed, over spending IT projects in Australia (either public or private) but I doubt it's worse here than UK, US, Denmark or where ever else. And to blame it on "Programmers" or siloed universities is about the laziest piece of analysis I've read in anything (including Trump tweets) for ages. There are real issues in IT generally is Aus, eg large orgs outsourcing all their dev work to large and small SI's, no in house capabilities for anything other than limited governance, a reluctance to take on and train grads and a million other things. Security is definitely something that needs to change. In my experience IT security has often been seen as a infrastructure job rather than a holistic practice that covers the life cycle of systems, but the first time I worked with a security dev team was a government org, which was great. They were much less about the firewalls, and much more focussed on good security practices, the poor application of which by devs were often demonstrated at fortnightly showcases where they would demo exploits in real time. Especially awesome was the time they dropped the entire "user" database table with some magic Hibernate exploit.
- microcolonel 9y ago
  >I doubt it's worse here than UK, US, Denmark or where ever else. Don't go lumping the U.S. in with the UK and Denmark, it's a completely different world.
- bigger_cheese 9y ago
  > "There are real issues in IT generally is Aus, eg large orgs outsourcing all their dev work to large and small SI's, no in house capabilities for anything other than limited governance, a reluctance to take on and train grads and a million other things. Security is definitely something that needs to change. In my experience IT security has often been seen as a infrastructure job rather than a holistic practice that covers the life cycle of systems" This is spot on I think. I work for an Australian private enterprise-ish organisation almost all of our IT is outsourced. The contract gets renewed every few years and goes to basically whomever is cheapest bidder which means offshore Indian/Malaysian etc support. As far as I can see cost is only consideration given to who gets the IT contract. And I'm pretty sure these outsourced workers are under pressures of their own the impression I've gotten from my limited dealings is they seem to be mostly focused on closing tickets - I'm guessing they have some kind of performance metric based on open tickets. Often if I report an issue ticket will get silently closed and I have to escalate several times before any action - This isn't really an environment that encourages "best practices" frustrating.
  - sytringy05 9y ago
    I'm a consultant and my last 2 clients have been going through changing outsourced service providers because "The last guys were hopeless/too expensive/just liked arguing about contracts" or whatever. I can't for the life of me understand why large companies don't want their own in-house dev/infra capability. They do everything they can to give it to someone else and then pay companies like my employer $2k a day for me to sit here and write unit tests, ansible playbooks and no end of just bog standard dev jobs. In my case I'm meant to be mostly doing architecture rather than dev, but what good is the architecture when the actual systems and applications are not looked after properly?
Untit1ed 9y ago
> Wilson says the evangelism over Agile working and minimum viable products has resulted in poor security practices becoming commonplace procedure. Even if it's food for thought in general, this is a pretty weak argument as applied to the Australian government - agile practices haven't made a lot of inroads there, particularly projects supplied by companies like IBM who tend to use super-rigid waterfall. If anything the recent failures prove that less-agile processes don't guarantee you anything in terms of security.
aryehof 9y ago
My view is that any non-trivial project should have explicit non-functional requirements relating to security (amongst others). Almost none do. Creation of those written requirements, and ensuring they are fulfilled, requires the use of security experts. Sadly, most IT project management have no understanding of this. It seems that a successful project has become one that is "satisfactory" to stakeholders. Security and compliance and other non-functional requirements too often are just afterthoughts.
zmmmmm 9y ago
Sadly I witness some of this firsthand and agree with most of it. There's a lack of maturity around software in Australia from a whole lot of angles compared to other countries. There's a general unwillingness to see software as a core competency and a competitive advantage, and a default assumption that outsourcing everything is the only sensible path. Lack of sophistication in understanding security problems is just one symptom of it.
neotek 9y ago
This is the same government that scoffed when people were up in arms about the national census perpetually storing personally identifiable information for the first time last year. "It'll never happen!" they said, "we have strong security systems!"
solatic 9y ago
> our software sucks because our programmers have no standards and because Agile can't deliver secure products This is complete rubbish. Management's number one responsibility is to set standards and enforce them, no matter what industry you're in. If the programmers are churning out trash, it's management's responsibility to send it back and hold them to standard. If management accepts trash, then the final product will be trash. That's not the programmers' fault, that's management's fault. And saying that Agile can't deliver secure products is like saying field commanders can't react to changing conditions on the field. Agile is specifically what allows organizations to produce secure software! Agile is precisely what allows management to take exploit reports, prioritize them, and quickly ship fixes, and not wait months on end for the next waterfall iteration to introduce a fix. Agile is precisely what allows organizations to introduce security policy professionals into regular planning meetings and give them a say over the direction and manner of development, so that organizations can take a more holistic approach to security, rather than introduce them at the end of the waterfall during integration, where fixing fundamental problems would result in costly delays and the result is an over-reliance on firewalls and segmentation. Insecure software is not inevitable. Management needs to prioritize a) hiring competent security professionals b) budgeting enough money for salary so that they'll actually respond to head-hunters c) give them veto/enforcement rights to prevent shipping insecure product d) give them a seat at the table so that security issues can be fixed and security as a holistic corporate culture can be adopted over time.

44 points by Khaine 9y ago

> “The truth is, programmers are hasty,” he said. “They under document, they under analyse, they under think, they under test, and Agile software development just gives them license to cut corners." Agile development has a lot to answer for. It's sadly been largely elevated to a religion which excludes innovation and thought about improvement.

microcolonel 9y ago

PSA regarding scrolljacking: please, not even once, please. Here is an archive link so you don't need to suffer it: http://archive.is/0ELqt http://archive.is/0ELqt

sytringy05 9y ago

This article is generalised rubbish. That's not to say there's a shortage of badly managed, over spending IT projects in Australia (either public or private) but I doubt it's worse here than UK, US, Denmark or where ever else. And to blame it on "Programmers" or siloed universities is about the laziest piece of analysis I've read in anything (including Trump tweets) for ages. There are real issues in IT generally is Aus, eg large orgs outsourcing all their dev work to large and small SI's, no in house capabilities for anything other than limited governance, a reluctance to take on and train grads and a million other things. Security is definitely something that needs to change. In my experience IT security has often been seen as a infrastructure job rather than a holistic practice that covers the life cycle of systems, but the first time I worked with a security dev team was a government org, which was great. They were much less about the firewalls, and much more focussed on good security practices, the poor application of which by devs were often demonstrated at fortnightly showcases where they would demo exploits in real time. Especially awesome was the time they dropped the entire "user" database table with some magic Hibernate exploit.

microcolonel 9y ago
>I doubt it's worse here than UK, US, Denmark or where ever else. Don't go lumping the U.S. in with the UK and Denmark, it's a completely different world.
bigger_cheese 9y ago
> "There are real issues in IT generally is Aus, eg large orgs outsourcing all their dev work to large and small SI's, no in house capabilities for anything other than limited governance, a reluctance to take on and train grads and a million other things. Security is definitely something that needs to change. In my experience IT security has often been seen as a infrastructure job rather than a holistic practice that covers the life cycle of systems" This is spot on I think. I work for an Australian private enterprise-ish organisation almost all of our IT is outsourced. The contract gets renewed every few years and goes to basically whomever is cheapest bidder which means offshore Indian/Malaysian etc support. As far as I can see cost is only consideration given to who gets the IT contract. And I'm pretty sure these outsourced workers are under pressures of their own the impression I've gotten from my limited dealings is they seem to be mostly focused on closing tickets - I'm guessing they have some kind of performance metric based on open tickets. Often if I report an issue ticket will get silently closed and I have to escalate several times before any action - This isn't really an environment that encourages "best practices" frustrating.
- sytringy05 9y ago
  I'm a consultant and my last 2 clients have been going through changing outsourced service providers because "The last guys were hopeless/too expensive/just liked arguing about contracts" or whatever. I can't for the life of me understand why large companies don't want their own in-house dev/infra capability. They do everything they can to give it to someone else and then pay companies like my employer $2k a day for me to sit here and write unit tests, ansible playbooks and no end of just bog standard dev jobs. In my case I'm meant to be mostly doing architecture rather than dev, but what good is the architecture when the actual systems and applications are not looked after properly?

Untit1ed 9y ago

> Wilson says the evangelism over Agile working and minimum viable products has resulted in poor security practices becoming commonplace procedure. Even if it's food for thought in general, this is a pretty weak argument as applied to the Australian government - agile practices haven't made a lot of inroads there, particularly projects supplied by companies like IBM who tend to use super-rigid waterfall. If anything the recent failures prove that less-agile processes don't guarantee you anything in terms of security.

aryehof 9y ago

My view is that any non-trivial project should have explicit non-functional requirements relating to security (amongst others). Almost none do. Creation of those written requirements, and ensuring they are fulfilled, requires the use of security experts. Sadly, most IT project management have no understanding of this. It seems that a successful project has become one that is "satisfactory" to stakeholders. Security and compliance and other non-functional requirements too often are just afterthoughts.

zmmmmm 9y ago

Sadly I witness some of this firsthand and agree with most of it. There's a lack of maturity around software in Australia from a whole lot of angles compared to other countries. There's a general unwillingness to see software as a core competency and a competitive advantage, and a default assumption that outsourcing everything is the only sensible path. Lack of sophistication in understanding security problems is just one symptom of it.

neotek 9y ago

This is the same government that scoffed when people were up in arms about the national census perpetually storing personally identifiable information for the first time last year. "It'll never happen!" they said, "we have strong security systems!"

solatic 9y ago

> our software sucks because our programmers have no standards and because Agile can't deliver secure products This is complete rubbish. Management's number one responsibility is to set standards and enforce them, no matter what industry you're in. If the programmers are churning out trash, it's management's responsibility to send it back and hold them to standard. If management accepts trash, then the final product will be trash. That's not the programmers' fault, that's management's fault. And saying that Agile can't deliver secure products is like saying field commanders can't react to changing conditions on the field. Agile is specifically what allows organizations to produce secure software! Agile is precisely what allows management to take exploit reports, prioritize them, and quickly ship fixes, and not wait months on end for the next waterfall iteration to introduce a fix. Agile is precisely what allows organizations to introduce security policy professionals into regular planning meetings and give them a say over the direction and manner of development, so that organizations can take a more holistic approach to security, rather than introduce them at the end of the waterfall during integration, where fixing fundamental problems would result in costly delays and the result is an over-reliance on firewalls and segmentation. Insecure software is not inevitable. Management needs to prioritize a) hiring competent security professionals b) budgeting enough money for salary so that they'll actually respond to head-hunters c) give them veto/enforcement rights to prevent shipping insecure product d) give them a seat at the table so that security issues can be fixed and security as a holistic corporate culture can be adopted over time.