During the past 12 years or so, I've been helping many organizations and teams to build secure software systems. But what does a secure system actually mean to me? It means that the system has sufficient security controls and are resilient to attacks, and that we know how security has been addressed and what is the remaining security risk with it. I have some observations of what teams typically miss and how they can address these concerns.

As an IT security consultant, I often hear this phrase. My answer to this is normally: Are you sure? Then people look at me like I’m a fool because to most people a hacker attack is equal to having a virus spread across the network or a system break down – both with catastrophic consequences like lost data and revenue.