Re:Patreon laid off their security team
by mancerayder on Thursday September 08, 2022 @11:41PM
(#32775050)
It's not an attitude, it's my experience: the infosec teams are deputized to make assertions they aren't qualified to make. Most of the time they're the intended bridge between legalese/contracts/regulations and technology reality. The good ones do this creatively. The shitty ones do this blindly or perhaps bureaucratically, in the context here.
I've borne witness to infosec people so hands off I'm convinced they secretly have two jobs as remote workers.
Good DevOps and dev folks obviate infosec, leaving the latter roles to industries that mandate it.
Re:Patreon laid off their security team
by tikhonj on Thursday September 08, 2022 @08:58PM
(#32774053)
I would hope that the point of security systems would be to make the company secure.
Being bureaucratic and following "proper" procedures ranges from being a way to achieve that goal to being actively counterproductive. It's not exactly rare for a "proper" procedure to be optimized for CYA, compliance or security theater at the expense of actual security!
I think that's a wrong attitude to have. The entire point of security systems is to be bureaucratic, i.e. to follow proper procedures.
A good chunk of security incidents in the software industry could be avoided by people following procedures rather than winging it, the annoyance is often not justified or an indication that people are playing too fast and lose.