Securing The Supply Chain of Nothing

wimremes — Thu, 15 Sep 2022 22:10:06 GMT

While it is positioned as a rebuttal of the recent guidance published by CISA, NSA, and ODNI, I think this essay is brilliant and provides serious observations that should be considered in the context of any appsec effort.

Should be worth 5 CPEs but it probably isn't because apparently professionals are better off watching product webinars.

https://swagitda.com/blog/posts/securing-the-supply-chain-of-nothing/

Re: Securing The Supply Chain of Nothing

JoePete — Fri, 16 Sep 2022 15:01:16 GMT

Kind of like Freakanomics meets InfoSec?

The only point I found a little controversial was #1, slowing down development hurts security. But Kelly Shortridge sells me on their logic. Maybe I would counter that there is an "optimum" pace for development or that the schedule should follow the development calendar, not the marketing/product one. But there is Freakanomic logic to the idea that you sooner you release, the sooner you can fix.

My own experience, having come into security from the development side, is that software development models rarely match software development practices. Now, I imagine there are some places that adhere to a very thorough process, but my sense is they are more the exception, and increasingly so given the embrace of Agile. Then again, I may have just been a really bad developer.

topic Re: Securing The Supply Chain of Nothing in Tech Talk

Securing The Supply Chain of Nothing

Re: Securing The Supply Chain of Nothing