Comment by reaperducer | Hacker News Reader

Comment by reaperducer | Hacker News Reader

Parent Full thread

They inherently desire to work with the company’s Crown Jewels of data. They want unfettered access to, and want to give other people access to, an entire data warehouse of some of our company’s most sensitive customer information.

In my organization, the problem is the security people, not the marketing people. They're simply not responsive.

Someone on a non-IT team will send a message to someone in IT Security asking a question, checking to see if a procedure is correct, or if it's OK to so something, and the IT person simply won't get back to them in an acceptable timeframe.

I'm not talking about minutes. I'm talking days. I've seen my coworkers' IT Security tickets go unanswered for more than a week.

Yes, securing your big fancy data warehouse is very important. But guess what — hackers don't knock on the front door anymore. They're going through the small cracks that you allow to form when you don't realize that your job is securing the entire organization, not just your silo.

This is why the rest of the company is going around security to get things done. Because if the money doesn't keep flowing, everyone loses their jobs.

_Every single person_ in the security industry that I know is on the verge of burnout because we’re all running around trying to answer questions from other teams as fast as possible, but there just simply aren’t enough security people to go around, and I don’t think there ever will be. My security team coworkers each have a backlog of 50-100 unread slack DMs from developer teams looking for guidance at any given time, and it’s been that way for years. My team has been attempting to hire nonstop, but the pace of hiring can’t keep up with the demand.

Honestly, 1 week sounds totally reasonable to me. If you’re at the point where you need an answer immediately or it’s going to delay your timelines, then you didn’t plan your timelines very well, or you waited too long to engage your security team. You have to keep in mind that while you might be laser-focused on your app and think it’s the highest priority, your security team is likely dealing with hundreds of apps, each of which all claim to be the highest priority. Triaging has to happen, and it doesn’t always go in your favor. It really sucks for everyone involved, but I don’t see a good fix for it.

The sweet spot is empowering teams to make most security decisions on their own so the capacity of security people can be spent more wisely and development teams don’t have to wait for an answer except for in very rare cases, but the pessimist in me thinks we’re already too far behind on this and technology (and the opportunity for new security dangers to arise) moves too fast for us to ever catch up.

I think if you are acting in an advisory role, it's ok to have a backlog and take time to respond. If you are an approver/gatekeeper blocking ship of something, then it's not acceptable to just say "file a ticket, we'll get back to you as workload allows". Maybe have two tiers of tickets: Questions and approvals, giving approvals priority. At my company, the approvers are often the busiest people in the company (busy with other, non-approval related things too) and that never works well. You end up with frustrated clients looking to work around approvals.

Reply on news.ycombinator.com