> our software sucks because our programmers have no standards and because Agile can't deliver secure products This is complete rubbish. Management's number on

> our software sucks because our programmers have no standards and because Agile can't deliver secure products This is complete rubbish. Management's number one responsibility is to set standards and enforce them, no matter what industry you're in. If the programmers are churning out trash, it's management's responsibility to send it back and hold them to standard. If management accepts trash, then the final product will be trash. That's not the programmers' fault, that's management's fault. And saying that Agile can't deliver secure products is like saying field commanders can't react to changing conditions on the field. Agile is specifically what allows organizations to produce secure software! Agile is precisely what allows management to take exploit reports, prioritize them, and quickly ship fixes, and not wait months on end for the next waterfall iteration to introduce a fix. Agile is precisely what allows organizations to introduce security policy professionals into regular planning meetings and give them a say over the direction and manner of development, so that organizations can take a more holistic approach to security, rather than introduce them at the end of the waterfall during integration, where fixing fundamental problems would result in costly delays and the result is an over-reliance on firewalls and segmentation. Insecure software is not inevitable. Management needs to prioritize a) hiring competent security professionals b) budgeting enough money for salary so that they'll actually respond to head-hunters c) give them veto/enforcement rights to prevent shipping insecure product d) give them a seat at the table so that security issues can be fixed and security as a holistic corporate culture can be adopted over time.