Partner up with a security engineer/team. The mindset that creates is different from the mindset that destroys. The gap between enterprise software and secur

Partner up with a security engineer/team. The mindset that creates is different from the mindset that destroys. The gap between enterprise software and security has a very wide gulf. Security exploitation might require intimate hardware details lower than understanding how the OS works, things such as understanding the architecture of CPU as we have seen with recent speculation attacks on CPU. Nevertheless, tons have been published on security. Rule 1. Trust NO INPUT Rule 2. Trust NO INPUT Rule 3. Trust NO INPUT Outside of being compromised due to bad inputs, the other vectors are either logical flow emanating from complex system with different moving pieces, or stemming from bad practices such as using poorly vetted libraries, encryption schemes, running on insecure platforms, etc. As someone who works in both spaces, I can assure you that the there's a strong strain between the demands of enterprise to release their vague requirements to market and the demand of security to keep everything together. If you try to do both it's easy to end up with some blindness. Hire a security team, the airline engineers don't do the forensic, a different team does and tells them lessons learned.