Having crippling bureaucracy does have better correlation with security outcomes than the “move fast, break things” philosophy that most of the software industry lives by.

I’m not even blaming Zuck for that, he didn’t really invent it, though he certainly popularized it — he just made an astute observation of the dynamics in software and turned it into a company motto.

▲

Veserv 5 hours ago | parent [-]

Neither is correlated with good security outcomes against the prevailing threat landscape of profit-motivated, commercial, professional attackers with tiny budgets of a few million dollars. The standard is not "better", it is "adequate".

▲

keeda 4 hours ago | parent [-]

Correlation is not an absolute measure here, it’s relative. As is the entire concept of security.

As is what constitutes the standard of “adequate.” Which BTW is the standard in ALL engineering (not just security or software) because we live in a world where economic pressures apply and costs must be managed. Trivial example: bridges only use an “adequate” amount of steel and concrete because they are not free. The word “adequate” fundamentally involves the concept of tolerances. There’s a reason we consider over-engineering a bad thing.

So which development approach would you say is better correlated with good security outcomes?

▲

Veserv 3 hours ago | parent [-]

Adequate is making it uneconomical, or cost ineffective, for threats to your organization to attack you either deliberately or indiscriminately. Absent a specific organization, we can use a profile of commonplace, prevailing threats as a proxy. A profile of commonplace threats is, as I said before, a profit-motivated, commercial, professional group seeking a multi-million dollar payout and thus being profitable at a cost of a few million dollars per commercial target. That is "adequate" in the prevailing threat landscape if you are the "average" organization.

	▲	keeda an hour ago \| parent [-]
		That is a great definition of adequate for security! My point is that at scale, bureaucracy is a necessary (though not sufficient!) condition for achieving adequate security. Another way to look at it is, bureaucracy is an aspect of the corporate culture, and lasting security comes down to having the right culture. At least in that respect Microsoft is doing something right. Doubtlessly a lot of that bureaucracy is ineffective, but it's a signal that the cultural intention exists. As a relevant counterexample, we've never heard of these kind of processes at Meta and so you get Cambridge Analytica. My perspective is skewed by my experience being on a security-adjacent platform team for years. Our biggest challenge was not external threats, it was internal teams seeing us as friction on their productivity, to the extent that it regularly led to escalations. So when Cambridge Analytica happened, I played it up for all it's worth; Meta may move fast because they didn't have our "bureuacratic team", but look where it got them! Unfortunately the $25B penalty just happened last week... I'd have gotten infinite political mileage out of that.