3 ms·

A CISO told me that the role was to beg for resources and then to get fired if something goes wrong.

hn_throwaway_99 5y ago
Having seen how some CISOs "beg for resources", I pretty fundamentally believe most of this money is wasted anyway. The only way you can really get better security at a company is to have an ingrained security culture. I.e. developers are continually educated on secure coding practices and new threats, code reviews include security checklists, corporate security training includes continual social engineering tests and an atmosphere of continual improvement. And yes, that stuff does cost money, but that's rarely the resources I see CISO's fight for. Instead, they fight for lots of expensive software, things like useless, shitty WAFs or poorly built "network monitoring" software (which can be a huge threat vector in itself, just see the SolarWinds fiasco). Like many other comments here, I don't believe security is something you can "bolt on" at a company. Yes, there are specialized roles that a dedicated security team needs to fill, but unless everyone at the company has a true understanding of the value and importance of security vigilance, you're screwed.
- cutemonster 5y ago
  > code reviews include security checklists, Can I have a checklist please? Full stack web dev Edit: Here I found one https://www.michaelagreiler.com/security-code-review-checklist/ https://www.michaelagreiler.com/security-code-review-checkli...
  - MattPalmer1086 5y ago
    There are some bits phrased the wrong way around (e.g. are session parameters passed in URLs? Check!). You don't want to do that. But as list of things to consider, if you already understand what you're doing, its not too bad.
- MattPalmer1086 5y ago
  It's a huge problem in security to know what money is wasted or not. Not hacked yet? Lucky or wise? It's probably like the old saw about advertising. Half of all it is useless, we just don't know which half!
- MattPalmer1086 5y ago
  To your point about security culture vs. buying security appliances, you need both. They address different aspects of security. If you're only doing one of them, you're in trouble. Likewise for checkbox ticking security-by-compliance. I strongly agree though that you can't really bolt on security, it needs to be designed in and part of the culture as much as possible. You'll never get everyone to understand the value though (I wish!).

Having seen how some CISOs "beg for resources", I pretty fundamentally believe most of this money is wasted anyway. The only way you can really get better security at a company is to have an ingrained security culture. I.e. developers are continually educated on secure coding practices and new threats, code reviews include security checklists, corporate security training includes continual social engineering tests and an atmosphere of continual improvement. And yes, that stuff does cost money, but that's rarely the resources I see CISO's fight for. Instead, they fight for lots of expensive software, things like useless, shitty WAFs or poorly built "network monitoring" software (which can be a huge threat vector in itself, just see the SolarWinds fiasco). Like many other comments here, I don't believe security is something you can "bolt on" at a company. Yes, there are specialized roles that a dedicated security team needs to fill, but unless everyone at the company has a true understanding of the value and importance of security vigilance, you're screwed.

cutemonster 5y ago
> code reviews include security checklists, Can I have a checklist please? Full stack web dev Edit: Here I found one https://www.michaelagreiler.com/security-code-review-checklist/ https://www.michaelagreiler.com/security-code-review-checkli...
- MattPalmer1086 5y ago
  There are some bits phrased the wrong way around (e.g. are session parameters passed in URLs? Check!). You don't want to do that. But as list of things to consider, if you already understand what you're doing, its not too bad.
MattPalmer1086 5y ago
It's a huge problem in security to know what money is wasted or not. Not hacked yet? Lucky or wise? It's probably like the old saw about advertising. Half of all it is useless, we just don't know which half!
MattPalmer1086 5y ago
To your point about security culture vs. buying security appliances, you need both. They address different aspects of security. If you're only doing one of them, you're in trouble. Likewise for checkbox ticking security-by-compliance. I strongly agree though that you can't really bolt on security, it needs to be designed in and part of the culture as much as possible. You'll never get everyone to understand the value though (I wish!).