Think Like An Attacker? Flip that advice!
For many years, I have been saying that “think like an attacker” is bad advice for most people. For example:
Here’s what’s wrong with think like an attacker: most people have no clue how to do it. They don’t know what matters to an attacker. They don’t know how an attacker spends their day. They don’t know how an attacker approaches a problem. Telling people to think like an attacker isn’t prescriptive or clear.
And I’ve been challenging people to think like a professional chef to help them understand why it’s not useful advice. But now, I’ve been one-upped, and, depending on audience, I have a new line to use.
Last week, on Veracode’s blog, Pete Chestna provides the perfect flip of “think like an attacker” to re-frame problems for security people. It’s “think like a developer.” If you, oh great security guru, cannot think like a developer, for heavens sake, stop asking developers to think like attackers.
Great insight Adam. A great way to bridge the gap is to put security and development together on a cross functional scrum team. By making both responsible for delivering functionality to the business, empathy will increase on both sides.