| ▲ | impossiblefork 2 days ago | |||||||||||||||||||||||||||||||
But why you hire consultants to solve core security problems? Furthermore, surely it would just be one guy who knows OS and FPGA stuff and another guy to check it? What I'm arguing for is that a sensible solution to security problems is to avoid complexity, so that things can be obviously secure. Carefully defined interfaces designed to be clear, impossible to misinterpret and which are designed to be parsed and implemented without doing anything requiring some kind of fiddly parsing that can lead difficulties, and small enough that someone can implement them in an afternoon; and then you combine that with a machine inherently robust to things like buffer overflows such as Harvard architecture type things, and it's easy even for a single engineer to program something like that up on an FPGA. | ||||||||||||||||||||||||||||||||
| ▲ | Spooky23 2 days ago | parent [-] | |||||||||||||||||||||||||||||||
You don’t. You hire them for other lower priority roles, but they are inside the firewall. Most large organizations have an immature zero trust environment. Look at the Microsoft PKI breach. The adversary was able to compromise certificate services in a corporate dev environment and parlay that in accessing US government mailboxes in a supposedly isolated cloud tenant. Microsoft has a world class security practice. The average Fortune 1000 is toast. | ||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||