3 ms·
Can do it in 4 questions: 1. What do you need to protect? 2. What is the complete list of tech stack technologies it depends on? 3. What are you doing to pro
by motohagiography 6y ago
Can do it in 4 questions:
1. What do you need to protect?
2. What is the complete list of tech stack technologies it depends on?
3. What are you doing to protect that important thing today?
4. Who do you need to protect it from?
If you can't answer these, the answers to the rest of the questions really don't matter.
- lawnchair_larry 6y agoWhat would you consider a disqualifier for question 2?
- cmeacham98 6y ago- "I don't know, nobody understands that legacy system from 10 years ago" - Very outdated and/or vulnerable software - Backups of customer data are stored unencrypted on dropbox - C/C++ (ok this one is a joke)
- motohagiography 6y agoThe way it works is if you don't have the answer, you collect what you can know and move with that. Also C/C++ means you need a linter, a code review process, VAs, and potential exposure to FOSS libraries. This method is mainly for building things, but if they are legacy, the information should be available as well. The top level answer of "nobody understands this," is pretty much the most important thing you need to know from a security perspective. It is funny, but it's funny because it's true and important.