4 ms·
The answer for that would ideally be all? We, as developers should be aware and ready to learn and build the experience around security , but a different thing
by goliatone 8y ago
The answer for that would ideally be all? We, as developers should be aware and ready to learn and build the experience around security , but a different thing are focus and ownership. You still want experts to drive specialized fields. I run all my architecture reviews by the security team and ask them to comment- internal RFCs. Very similar approach as with infrastructure/devops. Except the gap between dev and security is wither than between dev and ops.
I recognize that is very dependent on both organizations and individuals but I shy away from hiring people that at don’t have at the very minimum the interest or awareness in security. I also shy away from business that see security as an afterthought
- tptacek 8y agoI just want the standard to be coherent. If it's "you have to know everything", then fine, let's say that. But saying things like "at least they should know the OWASP Top 10" doesn't make much sense to me.
- Alex3917 8y agoAren't most (non-insider) data breaches the result of OWASP top 10 things though? If the goal of security is to make sure the costs of stealing an asset exceed the value of that asset, then ensuring that the least-expensive-to-exploit vulnerabilities have been mitigated first seems like a good place to start. The fact that there may be other vulnerabilities that are just as dangerous doesn't mean it's equally bad to have vulnerabilities like that, if they require more time and sophistication to exploit. E.g. you shouldn't have string comparison timing vulnerabilities in your code, but having them is less bad than a SQL injection attack even if they can both lead to the same result.
- tptacek 8y agoNo, I don't think there's much science to the OWASP Top 10.