3 ms·
Every time I see an exposure like this I'm reminded of a couple things... 1. Security everywhere is an after thought. How many people have performed a threat a
by mfer 6y ago
Every time I see an exposure like this I'm reminded of a couple things...
1. Security everywhere is an after thought. How many people have performed a threat analysis of the app they're working on? How many have management who will slow down velocity on features to put the time in to securing personal information?
When the culture isn't there the training isn't there either.
2. I don't know if it's the case here but, in the move to move more work on to app developers (ops, etc) there is only so much they can learn while still delivering on the things. How much of the reality of overloading app developers adds to this?
- i_haz_rabies 6y agoAnother, somewhat related issue is the fragmenting of teams. Having a few in-house devs, an outsourced team in Argentina, and a few other contractors, all coordinated by non-technical managers. This more or less describes all the projects I've worked on in my career and it creates the ideal conditions for security problems.
- mfer 6y agoThere are ways to combat that. For example, some clear processes and documentation. This will help many other issues in organizations as well. Someone can have security as part of their KPI. That will put a focus on it.
- alisonkisk 6y agoI don't think it's possible for a sub-$1B consumer operation to be secure, unless they operate inside a very tight sandbox where all the data and processing live inside a Google/Apple/similar sandbox. If the data is managed by the vendor system (which includes most data-monetization plays), it's leaked. Security is too complicated and expensive to get right.
- mfer 6y agoSecurity isn't a binary state. It's more layered like an onion. There are a lot of layers that even a small startup can do... that many don't.