travismcpeak

Anyone else think this indicates a lower short-term floor (say, 4.x%) than previously thought?

Totally agree with you on this one, it's the role of specialized platform teams + managers to make sure devs have the tools they need while also accounting for their skill level(s).

This does a great job of highlighting why properly configuring infrastructure is hard: S3 buckets (one of the most simple cloud infra services) have 70 configuration options.

Imagine you're a junior dev and your manager says "just spin up an S3 bucket and drop the data there, and make sure your app can access it".

S3 does have some sensible defaults, but a lot of Terraform modules do not...imagine somebody who now has to decipher S3's basic properties, ACLs, IAM, etc.

Resourcely is 100% remote and we're crushing it. We have more access to tech talent than companies that only hire in the Bay Area. This is a puff piece designed to get outrage clicks and nothing more.

This is really cool! How do you accomplish your research? I'm assuming IBM has some corporate records, but didn't realize they'd be this complete.

In my security career, it has become increasingly obvious to me what causes many incidents. At the same time, it is becoming harder to justify investment in solving that problem. I wrote this in the hopes it would help other people facing incidents caused by misconfiguration to advocate for addressing the root cause.

I don't know any big organizations that solely rely on GuardDuty. IMO, GuardDuty is great for a smaller company that wants something and doesn't want to have to buy/onboard/maintain a vendor.

Nice write-up!