Stefan-H
Joined 15 years ago
Joined 15 years ago
"The difficulty was the knowledge. You came to know that machine the way you come to know anything that pushes back. The resistance was the whole medium. You only ever know the things that you can lose to."
We who grew up in this era formed a hands-on engineer's knowledge of these systems, built from experience and practice, learning these layers of abstraction as the bleeding edge developed. Many these days have entered into a world where there are easy answers abound, they just might not be right, and one has to gauge how much they care about correctness.
Do you have people whose role is explicitly security? Who are the security SMEs in your organization if not? I personally find the "Security is so important to us that we don't have a team dedicated to it" argument weak, and often results in misaligned incentives - if individuals have to alternate hats from "deliver results" to "properly vet security", the business push to deliver tends to win out. I'd be very curious to hear how you ensure your team doesn't fall into that trap.
My comments represent only my own viewpoints.