Interesting effort. I do think their Expected Ideas, perpetuate the presumptions that cause security issues in the first place. " Data and link security,

Interesting effort. I do think their Expected Ideas, perpetuate the presumptions that cause security issues in the first place. " Data and link security, Ground and space equipment security, Protection of classified information, Keys management through full life cycle, Monitoring, situational awareness and forensic analysis of cyber-attacks, Technological enablers and transversal building blocks. " The most interesting thing I've found over the last 18 months is how few CISOs and secdevops people actually know what they are protecting, and from whom. Their worldview seems to end at, "the business!" which is a black box to them. Often, the sophistication and complexity of security technologies subtly moves risk out of the domain of business owners, and onto operations staff who aren't equipped to hold or meaningfully mitigate it, and the effect is that we're left with transferring risk to empty compliance rituals, or a company security troll who can be periodically scape-goated. I've got a horse in this race, but the solution is not for techs to educate business partners on security, but for owners to align their teams around the business risks that actually matter and let techs do what they do best, which is solve problems. ESA would benefit most from a tool that educated all their engineers and product owners on the things the agency and projects value, and the risks to them it perceives.