Apple Desperately Needs an SDL Program

We’ve been saying this for years but there’s a certain desperation today for an SDL-type program at Apple.   The security reality does not match Apple’s marketing/advertising and, as the Pwn2Own exploits show, the company is running around in circles trying to keep hackers at bay.  Apple needs to swallow hard and hire a security chief with experience in running a mandatory Security Development Lifecycle for all Internet-facing software.

We’ve been saying this for years but there’s a certain desperation today for an SDL-type program at Apple.   The security reality does not match Apple’s marketing/advertising and, as the Pwn2Own exploits show, the company is running around in circles trying to keep hackers at bay.  Apple needs to swallow hard and hire a security chief with experience in running a mandatory Security Development Lifecycle for all Internet-facing software.  This would help with things like threat modeling, mandatory training for developers, the proper implementation of security mitigations and, more importantly, software products and OS refreshes that can withstand security scrutiny.

Suggested articles

2020 Cybersecurity Trends to Watch

Mobile becomes a prime phishing attack vector, hackers will increasingly employ machine learning in attacks and cloud will increasingly be seen as fertile ground for compromise.

Top Mobile Security Stories of 2019

Cybercrime increasingly went mobile in 2019, with everything from Apple iPhone jailbreaks and rogue Android apps to 5G and mobile-first phishing dominating the news coverage. Here are Threatpost’s Top 10 mobile security stories of 2019.