4 ms·

I've done InfoSec for a bunch of startups, none seem to grasp the importance of security by design and how it can play an integral role in the business. It's ex

I've done InfoSec for a bunch of startups, none seem to grasp the importance of security by design and how it can play an integral role in the business. It's exhausting to have to battle a neon-haired developer that wants to just write code (rightfully so,) not following a process or standards often engaging in arguments just to be right. Imagine one person going asking an entire engineering org to create security priorities until business gets a hold of those and comes back to yell at you for delaying sprints, yep, that's InfoSec for you. Also, any business that says "We take security seriously" isn't. That's a boilerplate they plucked out of the legalese to CYA.

chickenfries 9y ago
edit: ah, nevermind, just a reference that went over my head
- mahyarm 9y ago
  It's a play on words about the pointy haired boss
  - 5706906c06c 9y ago
    I meant not offense to those with neon-colored hair, correct on the PHB read. Also, Wally is based on a person I worked with. Apparently, he worked with Scott Adams back in the PacBell days.
    - chickenfries 9y ago
      Aw, I feel bad about pointing it out now. I don't even have neon colored hair, but perhaps I am a bit jealous of the people who do.
dsfyu404ed 9y ago
This. Nothing is secure by design because anyone that can make it secure by design can get a job somewhere they're taken seriously.
CaptainZapp 9y ago
I certainly agree with your comment, since it reflects my experience in a lot of cases. But "We take security seriously" Why would such a statement legally cover your ass? From a legal perspective it sounds as dubious as warnings on a Truck "Stay back 10 metres. Truck is not responsible for damage"
- 5706906c06c 9y ago
  I can't disagree. However, it doesn't deter businesses from using it as it demonstrates intent to maintain certain security posture, regardless of how ill-conceived that posture might be. That said, the statement is touchy feely, and will more than likely not hold true in the court of law when pressure tested.

chickenfries 9y ago

edit: ah, nevermind, just a reference that went over my head

mahyarm 9y ago
It's a play on words about the pointy haired boss
- 5706906c06c 9y ago
  I meant not offense to those with neon-colored hair, correct on the PHB read. Also, Wally is based on a person I worked with. Apparently, he worked with Scott Adams back in the PacBell days.
  - chickenfries 9y ago
    Aw, I feel bad about pointing it out now. I don't even have neon colored hair, but perhaps I am a bit jealous of the people who do.

dsfyu404ed 9y ago

This. Nothing is secure by design because anyone that can make it secure by design can get a job somewhere they're taken seriously.

CaptainZapp 9y ago

I certainly agree with your comment, since it reflects my experience in a lot of cases. But "We take security seriously" Why would such a statement legally cover your ass? From a legal perspective it sounds as dubious as warnings on a Truck "Stay back 10 metres. Truck is not responsible for damage"

5706906c06c 9y ago
I can't disagree. However, it doesn't deter businesses from using it as it demonstrates intent to maintain certain security posture, regardless of how ill-conceived that posture might be. That said, the statement is touchy feely, and will more than likely not hold true in the court of law when pressure tested.