3 ms·
The thing about security is, it does not work well to try to just add it "on top". You have to overhaul the existing teams and processes, to basically be mindfu
by ploxiln 9y ago
The thing about security is, it does not work well to try to just add it "on top". You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care.
Just enumerating all the stuff you need to not do (e.g. "don't call system() with user input") is inefficient and not completely effective. In my opinion. "Scans" turn up a bunch of false positives and false negatives.
- Cyph0n 9y ago> You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care. Right, but this team is not only improving current devices, but also designing the next iteration of Cisco products with a focus on security.
- dmlorenzetti 9y agoThere's a new-ish book, "Secure by Design", that makes this point -- and shows ways for ordinary devs to design for security without explicitly thinking about security. I really like this book so far (it's still in the early access stage of writing). https://www.manning.com/books/secure-by-design https://www.manning.com/books/secure-by-design