Are We too Early for the Party? (the perils of Baking Cyber in from the Beginning)

Common Ground, 17:30 Wednesday A common cybersecurity trope often stated during/after security design and testing is “we/they should have built cyber in from the beginning.” BUT….How many of us have actually built cyber in from the beginning? The ...

Common Ground, 17:30 Wednesday

A common cybersecurity trope often stated during/after security design and testing is “we/they should have built cyber in from the beginning.” BUT….How many of us have actually built cyber in from the beginning? The presenters have an uncommon perspective on this matter, and are living the build cyber in dream/nightmare right now. We discuss the perils: product teams unwilling to incorporate cyber, lack of business processes incorporating good cyber design, the reluctance to develop secured designs during demonstration phases versus “certification-only” focus. We discuss the benefits (obvious & not so obvious): requirements documentation, identifying cybersecurity controls, interfacing with product teams, and building a value chain from the start. Just don’t expect being involved early to be the easy button.

Steve Bichler, Lillian Ash Baker