2 ms·
> But there aren't enough developers with that skillset to fill the open positions, so instead, they throw it over the wall to another team that improves the se
by rendall 5y ago
> But there aren't enough developers with that skillset to fill the open positions, so instead, they throw it over the wall to another team that improves the security.
The best- run companies I've seen with respect to this have regular and frequent security audits and assign tickets to the team who wrote the code, sometimes even to the developer who wrote it. Also, security is built into the continuous integration as much as possible.
- bitexploder 5y agoA good security engineering function as an organization goes a long way. As does security engineering having a good relationship with dev teams. It starts with developers believing in security and knowing how to transform that belief into action with appropriate change agents. There is always a lot more than audits for places with good security practices and developers who deal well with frequent audits.