what has changed since 2005 is that these ideas are no longer dumb, but describe the factors of the dynamic security teams have to manage now. previously, secur

what has changed since 2005 is that these ideas are no longer dumb, but describe the factors of the dynamic security teams have to manage now. previously, security was an engineering and gating problem when systems were less interdependent and complex, but now it's a policing and management problem where there is a level of pervasive risk that you find ways to extract value from. I would be interested in whether he still thinks these are true, as if you are doing security today, you are doing exactly these things. - educating users: absolutely the most effective and highest return tool available. - default permit: there are almost no problems you can't grow your way out of. there are zero startups, or even companies, that have been killed by breaches. - enumerating badness: when managing a dynamic, you need measurements. there is never zero badness, that's what makes it valuable. the change in badness over time is a proxy for the performance of your organization. - penetrate and patch: having that talent on your team yields irreplacable expereince. the only reason most programmers know about stacks and heaps today is from smashing them. - hacking is cool: 30 years later, what is cooler, hacking or marcus?