Hacker News Reader

The thing about security is, it does not work well to try to just add it "on top". You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care.

Just enumerating all the stuff you need to not do (e.g. "don't call system() with user input") is inefficient and not completely effective. In my opinion. "Scans" turn up a bunch of false positives and false negatives.

View on HN

There's a new-ish book, "Secure by Design", that makes this point -- and shows ways for ordinary devs to design for security without explicitly thinking about security.

I really like this book so far (it's still in the early access stage of writing).

https://www.manning.com/books/secure-by-design

> You have to overhaul the existing teams and processes, to basically be mindful, to think about this stuff and care.

Right, but this team is not only improving current devices, but also designing the next iteration of Cisco products with a focus on security.

Reply on news.ycombinator.com