Re:Cybersecurity Is Broken
by fireflash38 on Sunday April 07, 2024 @11:38AM
(#39961474)
Security, features, and speed of development all tend to be at odds with each other. And the major problem is: security doesn't gain money. The others do. Security is pure risk management.
So it will almost always get the backburner. Hell even if there are financial consequences: those don't matter if you don't really make money in the first place.
Ideally, Security Ownership should be taken up by the Application/Dev team with an open understanding that heads roll if you messed up ("ownership"), and a security team and platform team exists to help consult and implement security and deployment.
I guess they call philosophy "DevSecOps" or "Shift-Left" in the Gartner world.
That said, a lot of "security" practices are pure BS and security theatre.