Because cryptography is a specialized knowledge. Most curriculums doesn’t even include cryptography as core topic in their Computer Science degree. You can have a look of the MIT’s computer science curriculum. Cryptography is instead embedded in the elective class of Fundementals of Computer Security (6.1600). That’s also why DevSecOps instead of the previous DevOps. It’s just simply boils down teaching and learning cryptography is hard. It’s still too early to expect a typical dev to understand how to implement cryptograhy, even with good library. Most doesn’t know compression and encryption doesn’t mix well. Nor they understand the importance of randomness and never use the same nounce twice. They doesn’t even know they can’t use built-in string comparison (==) for verifying password hashes which can lead to timing attacks. Crypto lib devs who understands crypto add big scary warnings yet someone will mess something up.
Still, I will strongly support academics adding basic cryptography knowledge to their curriculum, like common algoritms, key lengths, future threats, and how fast the security landscape is moving, just for the sake of the future of cyber security.
Eh, I disagree. Cryptography really isn’t something your average software engineer needs to know about, as long as they understand that you should never roll your own crypto. If you teach it in school, most students will forget the details and potentially just remember some now-insecure details from their classes.
Instead, we should be pushing for more frequent security audits. Any halfway decent security audit would catch this, and probably a bunch of other issues they have as well. Expect that from any org with revenue above some level.
At least have few lessons let them remember not to roll their own crypto, and respect those scary warnings. These needs to be engraved into their mind.
I agree security audit would catch this, but that’s something after the fact. There is a need for a more preventative solution.
Security audits should be preventative. Have them before any significant change in infrastructure is released, and have them periodically as a backup.
I had a cryptography and security class in college (I took the elective), and honestly, we didn’t cover all that much that’s actually relevant to the industry, and everything that was relevant was quickly outdated. That’s not going to be a solution, we need a greater appreciation for security audits.
Because cryptography is a specialized knowledge. Most curriculums doesn’t even include cryptography as core topic in their Computer Science degree. You can have a look of the MIT’s computer science curriculum. Cryptography is instead embedded in the elective class of Fundementals of Computer Security (6.1600). That’s also why DevSecOps instead of the previous DevOps. It’s just simply boils down teaching and learning cryptography is hard. It’s still too early to expect a typical dev to understand how to implement cryptograhy, even with good library. Most doesn’t know compression and encryption doesn’t mix well. Nor they understand the importance of randomness and never use the same nounce twice. They doesn’t even know they can’t use built-in string comparison (
==) for verifying password hashes which can lead to timing attacks. Crypto lib devs who understands crypto add big scary warnings yet someone will mess something up.Still, I will strongly support academics adding basic cryptography knowledge to their curriculum, like common algoritms, key lengths, future threats, and how fast the security landscape is moving, just for the sake of the future of cyber security.
Eh, I disagree. Cryptography really isn’t something your average software engineer needs to know about, as long as they understand that you should never roll your own crypto. If you teach it in school, most students will forget the details and potentially just remember some now-insecure details from their classes.
Instead, we should be pushing for more frequent security audits. Any halfway decent security audit would catch this, and probably a bunch of other issues they have as well. Expect that from any org with revenue above some level.
At least have few lessons let them remember not to roll their own crypto, and respect those scary warnings. These needs to be engraved into their mind.
I agree security audit would catch this, but that’s something after the fact. There is a need for a more preventative solution.
Security audits should be preventative. Have them before any significant change in infrastructure is released, and have them periodically as a backup.
I had a cryptography and security class in college (I took the elective), and honestly, we didn’t cover all that much that’s actually relevant to the industry, and everything that was relevant was quickly outdated. That’s not going to be a solution, we need a greater appreciation for security audits.