On security and other things
I once read blogging advice: if someone asks you something, write it as a blog post and soon you will have a blog. One advice I am often asked is “I am a new startup; how should I approach security?” Here goes my attempt, based on my experience working at and advising hypergrowth companies. Please send me your thoughts and feedback! Who is this for? # This is advice for early-stage startups…
One of the first lessons in cryptography 101 is Kerckhoffs’s law : a cryptosystem should be secure even if everything about the system, except the key, is public knowledge. This is an often-repeated maxim accompanied with “there is no security with obscurity.” I always found this framing confusing: it felt inconsistent within itself. “ don’t rely on secrecy except for the secrecy of the key ” What…
tl;dr : Historically, heavyweight, slow static analysis tools focused on finding vulnerabilities. This approach is fundamentally not the right path for scaling security in modern development. Security teams today need tools that are fast, customizable to our codebases, can easily be added to any part of the SDLC, and are effective at enforcing secure coding patterns to prevent vulnerabilities One…