In my opinion, security needs to be the easiest path

Making doing things right has to be easy. You also need excellent monitoring, because it's inevitable someone will do something else no matter how easy. There are plenty of people and teams who just want a button to push to run their build. That's not so hard. Give them a CI/CD system and they'll use it. The problem becomes the people who want to use weird, wildly divergent build processes made of fifteen shell scripts strung together and downloading arbitrary content from random remote servers because they enjoyed engineering it. They'll insist on having a blank slate of a cloud tenancy because no build system can meet their needs. The CI/CD team does not take this case seriously and will never meaningfully support it. Security is in no way staffed to build out a major extension of the CI/CD service. Perhaps it's the data team, who has decided they would like to datamine large quantitie…

> are because some Marketing person, set up an AWS instance, dumped their entire user DB into it, and did a bunch of data mining What the actual **. That's a very hefty GDPR violation and you should be fired for doing that. > simply to be productive If you are using private and sensitive data, that should be pretty much out of the question. You develop with a dummy database only, which doesn't matter if leaked. And after having finished testing, move to the actual data. But those damned deadlines ...

Hit the nail on the head. As a security person, the marketing and data engineering teams at my company are what keeps me up at night. They inherently desire to work with the company’s Crown Jewels of data. They want unfettered access to, and want to give other people access to, an entire data warehouse of some of our company’s most sensitive customer information. And when it comes to securing it properly, they often do not have the same engineering capabilities as software teams.

> So many times, security has so many roadblocks, that folks work around it, simply to be productive. This has been my experience. We had someone set a secure instance following all the policies and such. Then they moved to another org in the company and I started getting email violations going to the VP every few weeks because they didn't do some sort of attestation. The problem was only the user could do it and the automation had no guidance on how resolve the issue or stop the alerts. This went on for months before it was resolved.

I also believe that there is a culture of not actually firing people who do stupid things like this. A mistake is one thing, but negligence is another. Beyond that, whoever allows customer data to be freely accessed and used in cases like this should also be fired. Start culling those who are doing the job poorly to start making space for others who may be able to do it properly.

> security needs to be the easiest path. If it is not, then that is the fault of the Security folks; not the end user. There's truth to what you say, but you're blaming the wrong crowd. Security people are rarely (if ever) the same people that are creating the tools and the security features of the tools you're using. In most cases, I'm powerless as a security engineer to "make security easy to use", the only thing I could do in that regard would be to loosen our security requirements and make our systems less secure, which isn't what you want either. IMO the problem is more that when developing products, security (and ease of security) is still not seen as that important of a feature (if its even seen as a feature at all and not an annoying cost that the product managers have to deal with). In our application security group, we actually do have requirements that any new product being bu…

The easiest path is always dangerous, because it's easier to avoid doing the right thing. It's easier to make cars without seatbelts. It's easier to avoid doing quality control for medication. It's easier to put lead in the paint. Somehow, computing hasn't realized that it is a field that maybe actually requires a little specialized knowledge. Would you let any rando fly an airplane? No, of course not. Why are we letting unqualified people write software?

> I suspect that having some kind of secure internal cloud setup would be helpful. It has to be secure and functional otherwise people will use office365 or google docs or dropbox. And now I wonder about AI tools. There are no self hosted solutions yet so what will the leaks look like ?