I Can't Be Blamed If We Never Decide Who's Responsible

Ann Barron-DiCamillo

Stay close to the business and close to the people doing the work. If security only shows up to review a decision after it's been made, we are already too late.

Ann Barron-DiCamillo

And the job is to help organizations move securely, not simply tell them why it cannot move.

David Spark

Most companies are only measuring whether people are using the tool, not what the tool actually changed.

Ann Barron-DiCamillo

Yeah, I think you start by making accountability explicit before you automate the work.

SPEAKER_D

And so if you start by documenting these shadows without understanding the business,

Ann Barron-DiCamillo

So I agree with Jen's core premise.

SPEAKER_D

And the simplest evidence I'm going to ask for is we have massive open source libraries.

SPEAKER_D

They have massive oversight by government.

SPEAKER_D

Simply because it includes one element that the other one doesn't, which is an active choice.

SPEAKER_D

If you survive B, you actually end up as a healthier company.

Ann Barron-DiCamillo

I think the important discipline is identifying the scenario, estimating the frequency and the impact.

Ann Barron-DiCamillo

Where I become cautious is more of like the false precision that can happen when you're focusing too much on dollars.

SPEAKER_D

Like what are fairy tales, but ways to make risk consumable to somebody who is not an expert.

SPEAKER_D

Of who's going to get in versus kick out the person who's already in, you're never going to hit that to zero if you're reactive.

Ann Barron-DiCamillo

I think AI is not eliminating the need for security fundamentals, it's just changing the speed and the economics of both attack and defense.