3 ms·

Good. I can't talk about what I saw while working there, but let's just say that I have a nervous tic when someone tells we have a team for security so you nee

Good. I can't talk about what I saw while working there, but let's just say that I have a nervous tic when someone tells we have a team for security so you need not worry, and when can you have it done by

esafak 3y ago
Are there any lessons you can share?
- 1attice 3y ago
  Yes. If your boss tells you that security isn't your concern as an IC, because other (presumably more specialized) minds are going to be reviewing everything later anyway, try to get transferred. It's not malicious, but the effect is sort of like wearing a blindfold and one hand juggling, throwing things in the air, and presuming that a right hand (a) exists and (b) is not currently holding several other balls. Everyone was super lovely and awesome and smart, but there is (for whatever reason) an attitude that is one of those things that is handled/reviewed by a special team, like accessibility, or HR, or product design, or backups. The thing is, we did have a great security team, it's just that expecting them to have local knowledge of every single line of code is obviously unfair to them, and the idea that you can "do security" on any product just by applying a fixed set of rules somewhere way down the pipeline is to grossly misunderstand how vulns happen and work. Every single IC can and must be on the lookout for vulns. They're vulns. They are literally made out of eyeballs pointed elsewhere. Security is like hygiene: everyone has to wash their own hands after they go, it makes no sense to think that everyone can save time by having a Department of Hand Sanitization.
  - physicles 3y ago
    That’s unfortunate. When I was on windows phone in the late 2000s, every new feature got a round of threat modeling. Each team (pm/test/dev) were responsible for building the threat model themselves, but the threat model was reviewed by another security team. What the hell happened? Is annual security training still a thing?
    - 1attice 3y ago
      There's still annual security training, but it's tapas-model. So basically you have to take N courses by <date>. If you're interested in lockpicking, but your job is in the cloud, you could still meet the requirement by watching a video about lockpicking. (If such a video was offered.) No one follows up, except to ensure that you took enough courses by the given date. Note: My time at this company overlapped heavily with Covid WFH, so things may have been looser/weirder than normal. And regarding threat modelling: I literally have no idea; I was just an IC. All I know is, there were several occasions where delivery cadence was selected for, and in my opinion, on at least some of those occasions, security should have been selected for instead. One charitable explanation is that they'd just threat-modelled my part of the product and decided there weren't any threats there, so there was no need to ease up on the gas pedal. But some threats are subtle, and where you least expect them.
    - Arnavion 3y ago
      >Each team (pm/test/dev) were responsible for building the threat model themselves, but the threat model was reviewed by another security team. That still happens. >Is annual security training still a thing? Yes it is.

esafak 3y ago

Are there any lessons you can share?

1attice 3y ago
Yes. If your boss tells you that security isn't your concern as an IC, because other (presumably more specialized) minds are going to be reviewing everything later anyway, try to get transferred. It's not malicious, but the effect is sort of like wearing a blindfold and one hand juggling, throwing things in the air, and presuming that a right hand (a) exists and (b) is not currently holding several other balls. Everyone was super lovely and awesome and smart, but there is (for whatever reason) an attitude that is one of those things that is handled/reviewed by a special team, like accessibility, or HR, or product design, or backups. The thing is, we did have a great security team, it's just that expecting them to have local knowledge of every single line of code is obviously unfair to them, and the idea that you can "do security" on any product just by applying a fixed set of rules somewhere way down the pipeline is to grossly misunderstand how vulns happen and work. Every single IC can and must be on the lookout for vulns. They're vulns. They are literally made out of eyeballs pointed elsewhere. Security is like hygiene: everyone has to wash their own hands after they go, it makes no sense to think that everyone can save time by having a Department of Hand Sanitization.
- physicles 3y ago
  That’s unfortunate. When I was on windows phone in the late 2000s, every new feature got a round of threat modeling. Each team (pm/test/dev) were responsible for building the threat model themselves, but the threat model was reviewed by another security team. What the hell happened? Is annual security training still a thing?
  - 1attice 3y ago
    There's still annual security training, but it's tapas-model. So basically you have to take N courses by <date>. If you're interested in lockpicking, but your job is in the cloud, you could still meet the requirement by watching a video about lockpicking. (If such a video was offered.) No one follows up, except to ensure that you took enough courses by the given date. Note: My time at this company overlapped heavily with Covid WFH, so things may have been looser/weirder than normal. And regarding threat modelling: I literally have no idea; I was just an IC. All I know is, there were several occasions where delivery cadence was selected for, and in my opinion, on at least some of those occasions, security should have been selected for instead. One charitable explanation is that they'd just threat-modelled my part of the product and decided there weren't any threats there, so there was no need to ease up on the gas pedal. But some threats are subtle, and where you least expect them.
  - Arnavion 3y ago
    >Each team (pm/test/dev) were responsible for building the threat model themselves, but the threat model was reviewed by another security team. That still happens. >Is annual security training still a thing? Yes it is.