As an industry, we transitioned from no focus on security to expecting an underfunded and under-tooled discipline to handle the topic for an entire organization.
From there, we started to shift the responsibility to produce and deploy software securely back onto developers and operators.
We did this without providing them the tools or training to perform these jobs effectively.
We’ve also neglected creating and deploying the kind of tools that enable an organization to assess if their SDL and overall security programs are effective, instead focusing on tactical tools without considering their effectiveness.
At the same time, we’ve continued to rely on blind faith that vendors are doing the right thing and have failed to hold them accountable for repeated mistakes.
In essence, we have regressed back to where we started, with voices in the corner screaming about how we need to be making informed decisions to mitigate threats proactively instead of chasing the latest novelty.
We can’t have it both ways. Either security teams continue to exist, work closely with the product and operations teams, and grow proportional to the teams they support, or we build the kind of products that allow security teams to assess what’s happening at scale, augmenting developers with expert systems that enable them to access the knowledge to design and build secure systems from the get-go.
We must stop papering over issues and make the right thing the easy thing.
@_ChezDaniela@Dave_Maynor Isn't that the Microsoft approach? Sorry to we messed up. Pay us more for those E5 licenses so you can tell us the next time it happens.
@lorenc_dan So sadly true, the response to customers has been "See, we told you that you should have been paying for E5 licenses. Do you want to write that check now?
@arynncrow Hopefully it was don't in a medical facility and you didn't wake up in a bathtub full of ice. Glad everything turned out OK. Maybe we can find a way to get @tomsegura to sign your appendix?
@MalwareJake @BrianVarnerVA This is what normally ends up happening but it's one of those fun questions for the auditors that don't suck. All 3 of them. I kid, I kid.
@BrianVarnerVA @MalwareJake It's a debate that I've seen regularly. If it's the same identifier for the account but a different credential is it was same account? Comes around the same discussions with step up auth, MFA, passkeys, etc.
@rmhrisk It's incredible how many threat models can be thrown out the window with a ball peen hammer. Also much easier approach if the target is work from home. Sometimes I hate that my brain works this way.