3 ms·

> [devs who don't heed to security primacy] should risk having their professional software development licenses revoked and companies being fined by watchdogs.

> [devs who don't heed to security primacy] should risk having their professional software development licenses revoked and companies being fined by watchdogs. But there is no such thing as a "software development license". Is that just naive wishful thinking? I mean, do you think that the way to secure systems is layer after layer of pain-in-the-ass red-tape and heavily silo-ed organizational structure? Instead of just forcing people to "dance to your tune" perhaps a more cooperative approach is better?

debatem1 8y ago
My phrase at a previous company was that "not every bug is a vulnerability, but every vulnerability is a bug". In that context our goal as a security team was to drive the total bug count to zero, both by helping to design systems which could be kept bug free and by aggressively hunting the kinds of bugs we really cared about. In my opinion, that was a great way to do business-- with the caveat that you can't be the only team committed to having zero bugs.
jodrellblank 8y ago
But there is no such thing as a "software development license". Is that just naive wishful thinking? It's normal wishful thinking. I mean, do you think that the way to secure systems is layer after layer of pain-in-the-ass red-tape and heavily silo-ed organizational structure? Basically, yes. Just look at them: https://informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/ https://informationisbeautiful.net/visualizations/worlds-big... - when Marriott Hotels leaks data, that's a shame, when the big and prominent tech companies can't stop it - LinkedIn, Google+, Twitter, Dell, Uber, Amazon, Sony - or the important Equifax, Healthcare.gov, NHS, IBM Health Net, that's damning. Do you want to trust your data to "a more cooperative approach" where people can debate whether security is too much of a negative nancy drag to bother with? Do you think we're at a stage now where this is winding down and everything important is basically secure? I don't. I think we've only seen the beginning of all the data leaks and sold information and dormant vulnerabilities, and that most systems are only considered "secure" because nobody has tried to attack them.
- crispyambulance 8y ago
  Hey, I agree we're only at the beginning of very bad things for information security problems. However, putting blame so heavily on the devs isn't constructive. They're subject to the same forces as the infosec people-- clueless corporate hierarchies and derpy project managers that blindly push through deliverables. And yes, I DO want to trust my data to orgs that take a cooperative problem-solving approach where people genuinely want to do the right thing, are encouraged to do so, and aren't afraid to challenge ideas. Sorry, but the info-sec "mall-cop" approach doesn't do this.

debatem1 8y ago

My phrase at a previous company was that "not every bug is a vulnerability, but every vulnerability is a bug". In that context our goal as a security team was to drive the total bug count to zero, both by helping to design systems which could be kept bug free and by aggressively hunting the kinds of bugs we really cared about. In my opinion, that was a great way to do business-- with the caveat that you can't be the only team committed to having zero bugs.

jodrellblank 8y ago

But there is no such thing as a "software development license". Is that just naive wishful thinking? It's normal wishful thinking. I mean, do you think that the way to secure systems is layer after layer of pain-in-the-ass red-tape and heavily silo-ed organizational structure? Basically, yes. Just look at them: https://informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/ https://informationisbeautiful.net/visualizations/worlds-big... - when Marriott Hotels leaks data, that's a shame, when the big and prominent tech companies can't stop it - LinkedIn, Google+, Twitter, Dell, Uber, Amazon, Sony - or the important Equifax, Healthcare.gov, NHS, IBM Health Net, that's damning. Do you want to trust your data to "a more cooperative approach" where people can debate whether security is too much of a negative nancy drag to bother with? Do you think we're at a stage now where this is winding down and everything important is basically secure? I don't. I think we've only seen the beginning of all the data leaks and sold information and dormant vulnerabilities, and that most systems are only considered "secure" because nobody has tried to attack them.

crispyambulance 8y ago
Hey, I agree we're only at the beginning of very bad things for information security problems. However, putting blame so heavily on the devs isn't constructive. They're subject to the same forces as the infosec people-- clueless corporate hierarchies and derpy project managers that blindly push through deliverables. And yes, I DO want to trust my data to orgs that take a cooperative problem-solving approach where people genuinely want to do the right thing, are encouraged to do so, and aren't afraid to challenge ideas. Sorry, but the info-sec "mall-cop" approach doesn't do this.