3 ms·
Then systems of governance are utterly broken and management should step in to enforce remedial actions, ASAP. But I disagree, security teams can and should ma
by chris_wot 9y ago
Then systems of governance are utterly broken and management should step in to enforce remedial actions, ASAP.
But I disagree, security teams can and should manage large networks with large numbers of stakeholders.
- tptacek 9y agoIf they can, why don't they? How many annual site-wide pentests have you heard of that failed hard? And those are the people savvy enough to conduct annual site-wide pentests!
- extrapickles 9y agoA common pentest isn't geared towards discovering architectural weaknesses like all Americans PII is one popped webserver away from disclosure. What's needed is an architectural security review, which is even rarer than people conducting an annual pentest.
- tptacek 9y agoWhat's your point? I'm saying, sitewide pentests almost always succeed.
- chris_wot 9y agoSo they keep going till they fail?
- tptacek 9y agoI don't understand your question. When I say a pentest succeeds, I mean that the testers succeeded in compromising their objective.
- wglb 9y agoThe target for most network pen tests is to obtain domain by noon of the first day. Generally, they keep going until they succeed and/or someone in the chain cries uncle.
- michaelt 9y agoIf they can, why don't they? Insufficient incentives, either caused by inadequate regulation or a belief the regulation won't be enforced. Think of the standards of network security and software validation used by, say, a Certificate Authority to keep their root certificates safe. Or by Google to secure GMail. Equifax just hasn't made reaching that standard their highest priority.
- tptacek 9y agoCertificate authorities to keep their root certificate keys safe... hmm... do go on. :) Google would be most people's exception to the rule I'm talking about here, having as they do one of the world's greatest information security teams. And Google has had major incidents!