cyber.hendryadrian.com
Security Insights · aikido.dev

Tyro CISO Says Developer Trust Is Essential to Effective Security Controls

· Original article ↗

Summary

Tyro CISO Arun Singh describes how poorly fitted controls can damage developer trust, and discusses a 7-day cooldown for new package versions and security tools integrated into developer workflows.

Key points

  • Removing local administrator rights across workstations disrupted productivity for some software engineers; Singh says it took a year to rebuild trust after his team found a compromise.
  • Singh says Tyro advocates waiting seven days before adopting a new package version, citing supply-chain attacks that exploit developers' encouragement to keep dependencies up to date.
  • Singh's team held workshops to explain the package cooldown policy and gain engineers' support.
  • Singh favors vulnerability, insecure-code-pattern, and secrets detection within the IDE, rather than scanning only after code is committed.
  • The article describes Aikido Device Protection as blocking malicious packages, browser extensions, and IDE plugins at install time; this is a vendor capability claim.

Article Details

Topic
Building developer trust through workflow-integrated security controls and a seven-day cooldown for new package versions

People

Arun SinghDiscusses his security leadership experience at Tyro, including developer trust, supply-chain risks, and security controls.Mike WilkesAikido Security's Enterprise CISO; discusses why enterprise security rollouts should account for cultural change and developer trust.

Vendors

AikidoThe problem compounds at scale. Mike Wilkes, Aikido Security's Enterprise CISO, argues most enterprise security rollouts fail because they're run like software deployments when they're actually cultural changes. At

Products

Aikido Device Protectioneven if you get the visibility, you can't do anything about it." What's needed is a tool like Aikido Device Protection that catches malicious packages, browser extensions, and IDE plugins at install time, silently

Related Articles