There is a middle ground between keeping users (in this case Engineering) happy and an environment secure.
Ideally, Security Ownership should be taken up by the Application/Dev team with an open understanding that heads roll if you messed up ("ownership"), and a security team and platform team exists to help consult and implement security and deployment.
I guess they call philosophy "DevSecOps" or "Shift-Left" in the Gartner world.
That said, a lot of "security" practices are pure BS and security theatre.
Re:Cybersecurity Is Broken
by fireflash38 on Sunday April 07, 2024 @11:38AM
(#39961474)
Security, features, and speed of development all tend to be at odds with each other. And the major problem is: security doesn't gain money. The others do. Security is pure risk management.
So it will almost always get the backburner. Hell even if there are financial consequences: those don't matter if you don't really make money in the first place.
Re:Cybersecurity Is Broken
by el_duderino_ on Saturday April 06, 2024 @07:09PM
(#39956514)
Remember that for an engineers job to continue to exist there is a need to ensure that the product and systems are secure.
Yeah well, this is why we don't like security engineers. You absolutely should care that the policies you push for are making workers feel restricted.
For your job to even exist, engineers must be able to produce just remember that.