If only the emphasis was on the security not on the vendoring.
It’s crazy how many defects you’ll find once you start poking around security products
Yeah I once pointed some supply chain software at itself and embarrassed the vendor badly.
90% of it is box ticking.
You are probably embarrassing the wrong people. Multiple layers of people before the engineers usually.
It hurt them all the way down. Believe me.
The best part of this memo is now you can use the memo's standards instead of the vendor's "stated" standards. And these standards are bleeding edge - very few products will actually pass muster.
would be fine except this is how we end up with mandatory invasive anti-virus forced onto all our laptops causing all kinds of problems and (yes!) security issues, 15 years after it was a good idea.
Stuff like this always makes me think of the Mr. Show sketch "Coupon, The Movie". "The FBI calls it warm... and mandatory!"