What we need to take away from the XZ Backdoor

Given that break-ins into corporate networks are now routine (and sometimes state-sponsored), the idea that data is somehow safer behind the corporate firewall is absurd. The only way to effectively secure data is strong encryption combined with rigorous hygiene around key management and access controls. This can be done as effectively in the cloud

As software engineers and architects our job is to try to use our technical and logical thinking skills to identify which is which and to challenge those that are not useful. Which activities help us to really be secure and which are outdated or simply useless “security theatre”? If we don’t do this then all security activities will be devalued and

Adopting a hacker’s mindset can help create a culture of pragmatism, valuing experimental and incomplete approaches.