5 ms·

This list is the "brute force" security algo. Eg 'just make everything more secure'. This would have someone upgrading a door lock with a hole in an adjacent wa

This list is the "brute force" security algo. Eg 'just make everything more secure'. This would have someone upgrading a door lock with a hole in an adjacent wall. There are at least the following major factors: * what might happen (event A,B, ...) ? * how probable is eventi? * what is the cost if eventi happens? * how can one deal with eventi? (action 1, 2 ...) ? * how much / how long does actioni take? * what actions should we perform with the skills/resources/time we have? My algo: 1 enumerate possible security issues 2 assign approx probability and cost to business 3 re-order by prob*cost 4 imagine ways to address issues, assign cost to address 5 decide on courses to address issues 6 for next epoch, address issues 7 goto 1

blowski 5y ago
That’s a good list and will improve the security of your own software. But in a bigger team, how do you make sure everyone is following the list effectively and consistently?
- aahortwwy 5y ago
  A starting point would be to have a dedicated team perform steps 1-3 as a service to all teams, individual teams become responsible for steps 4-6, and management assume responsibility for step 7 as well as overall goal setting (e.g. deciding by how much they want all teams to reduce/mitigate their risk over the coming epoch).
  - ryanbrunner 5y ago
    This definitely presumes a certain company size. The company I work for has 5 employees (2 in an engineering capacity), there's zero room for dedicated teams for anything. I've found even in a 100 person startup there's probably appetite for 1, MAYBE 2 people who are 100% dedicated to security.
    - aahortwwy 5y ago
      Well sure, the comment that I replied to specifically asked how you might apply the heuristic in a larger organization. With just a handful of people it can be applied by one security-conscious member of the team, and at that scale it's also viable to get everyone on board with applying it consistently.
aahortwwy 5y ago
This is a great comment. There's a bit more nuance in practice, but getting people thinking and talking this way is such a strong start.
raesene9 5y ago
I'd suggest that the best practice list approach may be a function of the target audience (SAAS CTOs) who may well not be well versed in security. Whilst a security professional should take an approach like the one you describe, it a) takes time and b) experience. Things like enumerating possible risks and assigning probability require a level of experience in security which may not be something a non-specialist has. Best practice approaches are necessarily less targeted, but I think they still have value in the sense of being good starting points.
- indymike 5y ago
  > I'd suggest that the best practice list approach may be a function of the target audience (SAAS CTOs) who may well not be well versed in security Perhaps the best place to start is with the lack of risk aversion that most startup founders have. In my experience, your are more likely to sell a startup type on the business opportunity that being secure creates as opposed to risk. You are likely dealing with a person who cannand will go all in on pair of threes.

blowski 5y ago

That’s a good list and will improve the security of your own software. But in a bigger team, how do you make sure everyone is following the list effectively and consistently?

aahortwwy 5y ago
A starting point would be to have a dedicated team perform steps 1-3 as a service to all teams, individual teams become responsible for steps 4-6, and management assume responsibility for step 7 as well as overall goal setting (e.g. deciding by how much they want all teams to reduce/mitigate their risk over the coming epoch).
- ryanbrunner 5y ago
  This definitely presumes a certain company size. The company I work for has 5 employees (2 in an engineering capacity), there's zero room for dedicated teams for anything. I've found even in a 100 person startup there's probably appetite for 1, MAYBE 2 people who are 100% dedicated to security.
  - aahortwwy 5y ago
    Well sure, the comment that I replied to specifically asked how you might apply the heuristic in a larger organization. With just a handful of people it can be applied by one security-conscious member of the team, and at that scale it's also viable to get everyone on board with applying it consistently.

aahortwwy 5y ago

This is a great comment. There's a bit more nuance in practice, but getting people thinking and talking this way is such a strong start.

raesene9 5y ago

I'd suggest that the best practice list approach may be a function of the target audience (SAAS CTOs) who may well not be well versed in security. Whilst a security professional should take an approach like the one you describe, it a) takes time and b) experience. Things like enumerating possible risks and assigning probability require a level of experience in security which may not be something a non-specialist has. Best practice approaches are necessarily less targeted, but I think they still have value in the sense of being good starting points.

indymike 5y ago
> I'd suggest that the best practice list approach may be a function of the target audience (SAAS CTOs) who may well not be well versed in security Perhaps the best place to start is with the lack of risk aversion that most startup founders have. In my experience, your are more likely to sell a startup type on the business opportunity that being secure creates as opposed to risk. You are likely dealing with a person who cannand will go all in on pair of threes.