I integrate people, process, and technology. Cybersecurity Workforce | Small Business Cybersecurity | Software Requirements | Data Integration | Business Analysis | Speaker | Writer | Systems Thinker
I've seen a lot of bugs. (No, not another cicada post). Software here. Egregious, immediately noticeable bugs. The opposite - those that require 6 concurrent conditions and 6 hairs from your nextdoor neighbor and it still only triggers once a month. (Okay, 7 conditions, 6 hairs...don't split those hairs). A continuum of buggage. Those complicated ones, sans the hyperbole - those are your Zero day issues. Regression testing doesn't find them. A super wily code-reviewing look-at-it-all software QA professional (I know the best one)...might...but probably not. How do we even engineer testing all of the complicated conditions? The interrelationships at runtime? I don't see a lot of talk about "how could we have caught this?" in public for disclosed issues. Most of the fixes for Zero days (those security holes best known because they're patched with updates to software like Google Chrome browser, Apple's ioS, Microsoft Windows) are downplayed. You get "Hey, user, look at these new features you're getting, and in whispered voice, "and security updates." Not familiar with the term? Zero day means a security issue without a patch. When the patch arrives, there's a remedy for the problem. Users often don't APPLY the remedy until much later...its own problem...prolonging the risk of the Zero day issue. Back to my kinda silly example. That's a wicked hard problem to test for. A bunch of concurrent situations that then trigger the problem. But, when the problem's a known issue, it's not hard to re-trigger. And therefore exploit. So what do we do? Other than fixing/patching, and communicating? What else is there to add to this conversation? Sunday thoughts. Sunday thoughts.
Heather Noggle, spot on! 👍🏽 It's time to move to DevSecOps by including security in every stage of the software development lifecycle. We're tired of patching and updating software every week due to vulnerabilities. 😎
Ryan Madigan
6mo
Great post! It's fascinating and crucial to explore not just the fixes but also the proactive steps we can take to anticipate and prevent those elusive, complex bugs
AI Strategist, Chief Of AI VCISO, Keynote speaker, LLM Whisperer, Passionate about people, Neuro Diverse Thinker
6moImplement destructive testing into the CI/CD pipeline smoke testing should be red smoke by QA testing as an adversary you greatly reduce your attack surface My.02 on a Sunday