the station / sector 09
Adversarial exposure
How to tell where you areAsk when someone last tried to break in on purpose, and what they were paid to find. If the answer is a scan nobody read, or a checklist somebody filled in, you are at the bad end. The distinguishing question is not whether you have security measures but whether anyone has adversarially tested them.
Every other sector on this site models accidental failure: something breaks, and the question is how fast you notice and how much it takes down. This one models an intelligent opponent who is deliberately searching for your weakest point and who will not file a bug report when they find it.
That difference is not a matter of degree. The feedback-latency argument — that shortening the loop between writing a defect and learning of it discounts every mistake — assumes defects surface through ordinary use. Security defects do not. An attacker who finds a vulnerability has every incentive to keep it quiet, so the loop never closes on its own no matter how fast your pipeline is. Finding these defects requires someone to go looking, adversarially, as a deliberate act.
This sector is charted as dark. The catalog has no controls on it yet, which is a statement about this catalog rather than about the sector.
Controls that move you along it
- ›One reviewer is not enough for security-relevant code
- ›A bot proposes the dependency update; a human still has to land it
- ›A detected secret is revoked automatically, on a clock
- ›Fuzz continuously, and read the bug counts sceptically
- ›No secret is ever committed, and something checks
- ›Threat-model the design, and keep doing it after the training
- ›Write new code in a memory-safe language
- ›Ask whether the vulnerable code ships before you treat it as urgent