4 ms·

Interesting points, but you seem to have missed responding to your last > quote. The "> Worse, many...". I'd be interested to see what your remarks are there.

• jacques_chester 9y ago
  Ah, good catch, and this is why I should wait for caffeine levels to peak before screeding. At work we have a lot of customers now, many of them with large security orgs. Their approaches vary a lot, presumably because of their experiences and security maturity. Beyond a certain level, there is always a security org and quite typically it has veto powers that override any local manager's budgetary concerns. Whether that veto is applied well is quite distinct from the way it creates a ceiling over potential spending on features. That all said, I agree that there are fundamental properties of security that will cause it to be consistently under-attended relative to what a more actuarial or financial model would suggest is rational. It is only observable in its absence, but most feedback systems -- formal or informal -- rely on observable signals. Market releases may lead to a juicy bonus at many companies. Invisible improvements won't. I've thought about this a lot in the past few months and published a bunch about it internally at Pivotal. I'm not alone, of course. We're streets ahead of many vendors, but I also feel we're only getting started on the deeper and more difficult process of blending it deeply into our cultural DNA. It's a culture which believes in doing the right thing, but also a culture which detects vetoes as faults and routes around them. Interesting times.