Comment Re:Amateur Hour in IT Security is over (Score 1) 16
Having talent in the industry that knows how to write secure software isn't enough. The managers need to prioritize the work and allocate sufficient time for it. There is *always* deadline pressure, with real money and consequences behind it, and so engineers need to present a compelling case that their more expensive secure way to do it is actually necessary.
Businesses love to ignore security holes if something else in the code prevents them from being exploitable. They often don't accept "well future code changes may expose this vulnerability." And they won't accept "this more expensive way of doing it is the industry best practice" if they think the cheaper way of doing it is secure enough.
Getting the bean-counters on board is the real victory. Once they actually care about security, they will be interested in hiring people who can do it well, which in turn will motivate technicians to study up on it.