>Blame always rises. Management knows that any product without extensive review is going to be bad. They push it out the door without that review because quality costs. Stockholders know. Software is bad because you can't sue the companies that made it.
I get that a variety of pressures are put on developers to add features and ship quickly.
But whether it's corporate development done internally (e.g., LOB applications), a web app or a SaaS offering, not designing security into the software is a disaster waiting to happen.
So many times I've seen businesses have their crown jewels ripped off due to poorly implemented/weak or non-existent security practices in application design/development.
Even when the infrastructure is reasonably well secured, with defense-in-depth, including strong authn/authz, separation of duties, as well as strong security processes and policies in place, software that lacks designed-in security can render all of it useless.
Whether that's because the software doesn't/can't integrate with the security tools in use (often requiring applications to run with much higher privilege than they should) or because little or no thought was given to secure coding mechanisms or access controls.
I absolutely understand that there are always security trade-offs, regardless of where in a multi-layered infrastructure/management/application environment.
And it's always important not to expend resources beyond what's appropriate for the assets being secured.
That said, application software is the most frequent culprit in enabling compromises (followed closely by poor security implementation in the infrastructure and a lack of policy/process in securing it -- usually through ignorance/incompetence).
My argument is not that developers are stupid or ignorant, but that security isn't baked-in to their design decisions as a guiding principle.
And that often leads to insecure software and/or sloppy/insecure integration of security after the fact.
If more developers thought about security as a feature rather than an inconvenience to be given little thought or just lip service, that would make a big difference.
Edit: Clarified verbiage and fixed typos.