Strategic thinking and doing

At my day job, I'm responsible for putting security into the Software Development Life Cycle. Unfortunately, there's not much of an SDLC to work with.

While the organization has an architect, he's too busy with short-term projects to focus on longer term strategy. His attention is on an encompassing portal project, while infrastructure issues such as developing standards relating to languages, tools and processes go unattended.

No two development teams work the same way. There's no central repository for code that can be shared across the enterprise. Even within the same team, developers don't have access to all of the same tools.

Few of the external facing web pages adhere to accepted web standards and even the branding is inconsistent. These are not security issues, but they reflect an overall pattern that permeates the organization's development efforts.

Part of me wonders if adapting the Fixing Broken Windows crime fighting approach might help us clean up all aspects of our development process the same way it helped clean up the streets of New York.

Freedom and security

If you want to see something about the nature of the relationship between freedom and security, go search flickr.com for images tagged with "freedom" and "security."