Re:Microsoft opens early access to AI assistant for infosec,...
by wnolens on Tuesday October 24, 2023 @02:10PM
(#38002981)
I think this is actually a great idea, and not just a vector for attack as some are seeing it.
I'm undergoing an intense security review process right now while designing a new service.
A broad stroke definition of the process might be "apply best-practices" which are sourced from domain experts, manifest as checklists (do you do XYZ?) which lead to heaps of documentation, as well as weekly consultations with a security pro assigned to our team.
We're very very lucky to have very deep pockets and decades of experience to draw from. Most won't. In fact.. so many things I am working on are to go above and beyond to protect our customers, who configure their application in insecure ways and then blame us..
I'm undergoing an intense security review process right now while designing a new service.
A broad stroke definition of the process might be "apply best-practices" which are sourced from domain experts, manifest as checklists (do you do XYZ?) which lead to heaps of documentation, as well as weekly consultations with a security pro assigned to our team.
We're very very lucky to have very deep pockets and decades of experience to draw from. Most won't. In fact.. so many things I am working on are to go above and beyond to protect our customers, who configure their application in insecure ways and then blame us..