Chris Wysopal on Nostr: As long as cybersecurity is treated as a criminal issue instead of a safety issue we ...

As long as cybersecurity is treated as a criminal issue instead of a safety issue we will continue to see cybersecurity as an elective for computer science students. As a computer & systems engineering student I was required to take a couple of mechanical engineering courses. One of the courses opened up on the first day with a video of the Tacoma Narrows bridge collapse due to high wind. I would love to see a first computer science class open up with a command injection attack compromising a web server and then follow through with lessons about building systems safely.

I have hope with the Secure by Design language being used that professors and students start to see systems vulnerable to attack as engineering failures and not just simply the way things need to be to innovate. Without secure software engineering the result is outsized risk that must be mitigated in a variety of expensive and ultimately ineffective ways.

We can't control bad actors just like can't control the wind. Design and build software with this in mind.