Member Contribution • Weekly CISO Podcast Pick
This Week’s Pick by David Cross (CISO, Atlassian)
Series curated by the CISO Platform community. Spotlighting practical listens for security leaders and their teams.
Why this episode matters
|
Copy-paste takeaways for your team
|
Standout ideas discussed
- The 15 to 18 year “security kernel” rabbit hole. Early attempts to enforce multi level security purely in kernels were academically elegant but commercially unusable, teaching the value of usability and market reality.
- The Orange Book to Common Criteria journey. Government criteria started as feature and documentation heavy and only later grappled with how easy it is to write vulnerable software.
- The Microsoft security push as culture change. Pausing feature work for thousands of engineers to focus on security, backed by the Trustworthy Computing memo, showed how leadership and engineering discipline must align.
- Secure development is not enough in the cloud era. Operations, configuration, supply chain, open source and post quantum migration all sit beside SDL, not behind it.
- AI and formal methods as double edged tools. AI can generate insecure code at scale, but better languages like Rust and modern verification techniques offer new ways to harden critical components.
Try this in the next 7 days
- Mini SDL health check: map one key product against a simple lifecycle (requirements, design, implementation, verification, release, response) and note where security activities are missing.
- Third party “giblets” review: pick a critical service and list all external libraries, open source components and services it depends on, then confirm how you track and patch them.
- Threat modeling workshop: run a 60 minute threat model on one internet facing flow, capturing assets, entry points, controls and the top three improvements.
About David Cross
David is CISO at Atlassian and a long-time community member at CISO Platform. His weekly picks are short-listed for practical signal - conversations that sharpen how we lead, not just what we deploy.
Want your pick featured next?We’re building a rotating slate of member recommendations from USA, Middle East, and India. If you’re a CISO or security leader, submit a link and 3 bullets on why it matters. |
How we choose
|
Comments