4 ms·
When does it not? Seriously, has anyone here worked somewhere security actually was front and center but people were also able to build new things?
by l0b0 6y ago
When does it not? Seriously, has anyone here worked somewhere security actually was front and center but people were also able to build new things?
- ironmagma 6y agoThe health technology space is kind of like this; HIPAA concerns etc. makes security a business continuity imperative.
- l0b0 6y agoFair point. On the other hand, do these ever go beyond the basic checklists which provide the absolute minimum to certify the software? I doubt it.
- ironmagma 6y agoSeems like more of a pessimist's take. I know the company I work at[1], at least has an ingrained culture of security that permeates through the org and dictates software development practices and tech stack. It probably helps to be a startup, where smaller missteps would be a bigger deal than for an established player. [1] https://www.commure.com/ https://www.commure.com/
- gliese1337 6y agoAnd the state of EMR software pretty much supports the point that it is, indeed, nearly impossible to build new things under those constraints....
- ironmagma 6y agoWell, EMRs are generally part of older, established presences which have inertia. But companies like Apple and Alto are innovating in the medical space, and they're still governed by HIPAA.
- strstr 6y agoMy current job at Google working on virtualization?
- lazyasciiart 6y agoCan't be that secure if you go around telling people that's what you do.
- tlarkworthy 6y agoDon't think it counts. That's a neccisary condition to multi tenancy cloud tech. It's a product feature that customers require and ask for.
- redis_mlc 6y ago- I know one company in SV that has done that for regulatory reasons, at huge, on-going financial expense. It's not normal. - if you have engineers with previous implementation experience on HITRUST or similar, it can be done. But it's hard to retrofit if everything that's installed is stale. - otherwise you end up with "paper certifications" without the engineering to support it. That works for a while, but eventually becomes a problem if an on-site audit is scheduled. https://en.wikipedia.org/wiki/HITRUST https://en.wikipedia.org/wiki/HITRUST
- raxxorrax 6y agoKind of. Normally network access is fairly restricted, as well as administration rights on machines but developers quickly are exempt from this for productive work. I remember sins like modifying SSL checks for several package managers. lie isValidTLSCert(){return true;//suuure} Today is is mostly a configuration issue. Of course you will never be praised for the security of a solution. If something bad happens security quickly becomes the most important thing of course.