3 ms·
Security at enterprise scale is pretty damned hard. Having been the only security guy in a large, and complex, engineering enterprise, it feels darned near imp
by AviationAtom 4y ago
Security at enterprise scale is pretty damned hard.
Having been the only security guy in a large, and complex, engineering enterprise, it feels darned near impossible. Security is often just regarded as an added expense, until something happens.
It really does take buy-in from everyone, understanding security, being invested in security, and consistently accounting for security, for a program to be super effective. Otherwise security is left playing whack-a-mole, asking teams to fix all the things they constantly are finding out of compliance.
- tlavoie 4y agoWhen the organization itself takes security seriously, it can be so much better. I'm at a telecom, where we have multiple security teams. Ours is all about security testing, and we're regularly meeting with dev teams to discuss findings, exploring them together if necessary. I'm not always sure about the project managers, but the developers definitely seem to appreciate the insights and guidance. I should note, understanding the issues helps, as you can also tell them what findings are irrelevant in their specific context. For web app security for instance, many issues are browser-related, and may not matter for inter-system API calls.