3 ms·

This article is just an extended developer moan about having to do security. Honestly, the recommendations in it are quite sane. I doubt anyone would do every

This article is just an extended developer moan about having to do security. Honestly, the recommendations in it are quite sane. I doubt anyone would do everything in it. Many of the items in it are not prescriptive, and are just examples of mitigations, but he seems to think that all of them are required. He bemoans that "non vendor tooling" isn't covered (whatever that is) and then talks about entire product categories like IDS, AV and DAST. Ummm... you dislike using commercial intrusion detection systems, anti virus and dynamic application scanning tools? You want to write your own? He attacks the report for wanting static analysis on code before it's checked in, and then immediately moans that there's no consideration for integrating static analysis into dev workflows and getting fast feedback. Hint: faster analysis that runs in the IDE solves both problems. He thinks 30 years of SCM systems mean the threat of modification of code has gone away. I got news for him... TL;DR straw man moan about security from someone who doesn't understand it.

goodpoint 4y ago
Nicely said.
kiesia 4y ago
This is written by a) a woman, and b) someone who works in information security.
- MattPalmer1086 4y ago
  My bad, I didn't check who wrote it. I assumed it was written from a developer perspective, as the arguments seem poorly made from an infosec perspective.
  - MattPalmer1086 4y ago
    To give some context here, I currently work on SDLC and dev security. Supply chain attacks are high on the agenda right now. I don't have a problem with this set of recommended practices. And that's all they are. These are things to consider and only constitute guidance, which may be out of date. It says all this in the intro.
- fedeb95 4y ago
  - MattPalmer1086 4y ago
    Hardly! I just didn't stop to check who the author was and made an unwarranted assumption. I'll make a mental note to do that from now on.
- Spooky23 4y ago
  Weird perspective from an infosec person. Controls are like brakes - they let the car go faster. There’s a lack of context as well… while intelligence agencies have a perspective fueled by lots of cash, many companies are working over their heads and adopting a “hold my beer” attitude with customer data.

goodpoint 4y ago

Nicely said.

kiesia 4y ago

This is written by a) a woman, and b) someone who works in information security.

MattPalmer1086 4y ago
My bad, I didn't check who wrote it. I assumed it was written from a developer perspective, as the arguments seem poorly made from an infosec perspective.
- MattPalmer1086 4y ago
  To give some context here, I currently work on SDLC and dev security. Supply chain attacks are high on the agenda right now. I don't have a problem with this set of recommended practices. And that's all they are. These are things to consider and only constitute guidance, which may be out of date. It says all this in the intro.
fedeb95 4y ago
- MattPalmer1086 4y ago
  Hardly! I just didn't stop to check who the author was and made an unwarranted assumption. I'll make a mental note to do that from now on.
Spooky23 4y ago
Weird perspective from an infosec person. Controls are like brakes - they let the car go faster. There’s a lack of context as well… while intelligence agencies have a perspective fueled by lots of cash, many companies are working over their heads and adopting a “hold my beer” attitude with customer data.