U.S. Treasury breached by hackers backed by foreign government – sources

That is precisely the same line of reasoning that started the Iraq War based on lies. The New York Times claimed to have intel from anonymous sources showing that Saddam Hussein had nuclear weapons, and their false reporting is what led the US to declare war. That snafu didn't happen all that long ago, and yet most people in 2020 seem to have blocked it out of their minds.

https://en.wikipedia.org/wiki/Provable_security

If you read that article you'll see that current approaches don't even attempt some kinds of proofs such as proof of security against side channel attacks. It goes by other names as well such as proof of code correctness:

https://www.schneier.com/blog/archives/2009/10/proving_a_com...

A major problem with current attempts at proofs is you can at best create a proof based on a system specification and what you want it to be secure against, which basically means you have to already know all possible attacks including zero day attacks. So far the field has resulted in nothing practically useful as far as I know. Homomorphic encryption might be close to being practical for a limited set of problems and could be provably secure for a limited set of attacks, though I don't know if anyone has attempted such a proof yet.

The Washington Post's record on verifying the claims of the US national security apparatus is poor. The newspaper uncritically reported false claims by the Bush administration about Iraqi WMD. Many people people at the time found those claims extremely dubious, but critical voices were belittled or shut out of most mainstream reporting. More recently, the Washington Post has been all-in on Russia paranoia. That doesn't mean that everything they publish about Russian hackers is wrong, but it very well may be misinformation leaked by US intelligence officials, or something insignificant blown out of proportion and presented without any context. In December 2016, for example, the Washington Post reported that the Russians had hacked a Vermont utility. That story turned out to be complete nonsense, but the Washington Post never fully retracted it. If you look at the story today, you'll still get the impression that the Russians attempted to hack the utility, even though that aspect of the story completely fell apart. The Washington Post on Russia is a bit like Bloomberg on Chinese hackers (e.g., Supermicro).

Another problem is that the complexity in modern systems is increasing and designing secure systems on top of complexity is next to impossible. I think Unikernels have a good chance of delivering secure systems from a software perspective, but it seems even modern hardware has enough vulnerabilities to thwart those plans.

I get that a variety of pressures are put on developers to add features and ship quickly.

But whether it's corporate development done internally (e.g., LOB applications), a web app or a SaaS offering, not designing security into the software is a disaster waiting to happen.

So many times I've seen businesses have their crown jewels ripped off due to poorly implemented/weak or non-existent security practices in application design/development.

Even when the infrastructure is reasonably well secured, with defense-in-depth, including strong authn/authz, separation of duties, as well as strong security processes and policies in place, software that lacks designed-in security can render all of it useless.

Whether that's because the software doesn't/can't integrate with the security tools in use (often requiring applications to run with much higher privilege than they should) or because little or no thought was given to secure coding mechanisms or access controls.

I absolutely understand that there are always security trade-offs, regardless of where in a multi-layered infrastructure/management/application environment.

And it's always important not to expend resources beyond what's appropriate for the assets being secured.

That said, application software is the most frequent culprit in enabling compromises (followed closely by poor security implementation in the infrastructure and a lack of policy/process in securing it -- usually through ignorance/incompetence).

My argument is not that developers are stupid or ignorant, but that security isn't baked-in to their design decisions as a guiding principle.

And that often leads to insecure software and/or sloppy/insecure integration of security after the fact.

If more developers thought about security as a feature rather than an inconvenience to be given little thought or just lip service, that would make a big difference.

Edit: Clarified verbiage and fixed typos.