4 ms·

This has the overall feeling of something developed by a team where leadership sincerely believes that security is everyone's job. Because it's everyone's job a

by Kalium 3y ago

This has the overall feeling of something developed by a team where leadership sincerely believes that security is everyone's job. Because it's everyone's job and they hire good people, they don't need specialists. When there are deadlines to hit, average quality non-specialist management will generally prioritize keeping promises to leadership over meeting security requirements. It takes a rare manager with a strong grasp of the importance of security to stand up and tell their VP "We're not shipping, the security isn't there". So how do these managers get there? They cut the corners that don't matter and hit the ship date. It gets them the promotion.

sbehere 3y ago
Replace 'Security' with 'Safety' and your comment still rings eerily true! One exception (? probably not an exception) is that sometimes organizations will still hire safety/security specialists (because the externally viewed perception of not having them is damaging), but these specialists are then (perhaps unintentionally) knee-capped to various extents in order to prioritize promises to leadership or other org. goals that must be hit. The net result is that good and capable folks who care deeply about the company's mission may watch in consternation as the org. slowly train wrecks itself if the roll of the dice doesn't land right. See, for example, the story of several autonomous driving organizations.