[threeseed]

Show me who I need to write a check to defend against a 0-day exploit that was used against Cisco networking equipment. Which in turn was used to compromise security mechanisms within the company.

Oh wait you can't. Which is why we had to turn to our government intelligence services to provide assistance.

So stop pretending like companies can defend against state sponsors who are buying 0-days for $100k+ like it's candy.

[nickpsecurity]

The NSA certified the Boeing SNS Server and BAE Systems XTS-400 as stuff they couldn't hack at that point. They're used as guards to protect secrets on classified site from attacks on Internet side. There's been no published hacks of those systems for almost 30 years. You could try to see if you can buy them. I linked to descriptions of some of those products here:

https://lobste.rs/s/o6x9b3/tech_s_masturbatory_historiograph...

I described what I learned about how high-assurance security builds stuff here:

https://pastebin.com/y3PufJ0V

As I often said, compare anything from security market advertised as secure against stuff on that list. If they're missing something, they're probably insecure. Now, I'm still not saying you can stop nation states and all 0-days. I am saying that most of the $100k 0-days are preventable with architectures like above with apps in safe languages with guards separating trusted things from untrusted things. Ada has also been around a long time with Rust getting popular now.

What makes most companies not use stuff like that isn't that level of security being unachievable: they just don't want to for management's reasons which range from arbitrary to sound practices in a profit-focused environment.