4 ms·
Sorry, I have to disagree. Performing regular pen testing is costly, so skiping it is a tradeoff. Employing a team of security engineers is also costly and ther
by Drdrdrq 9y ago
Sorry, I have to disagree. Performing regular pen testing is costly, so skiping it is a tradeoff. Employing a team of security engineers is also costly and there aren't enough of them to make that viable for all companies. Tradeoff. But putting such data in direct access of a web server, a single RCE away from exposure? That's not a tradeoff, that's negligence.
- tptacek 9y agoYou've lost me. I think you may have misunderstood my point about pentests. I mean "success" from the perspective of the testers: you asked me to own your network up, and I succeeded. My point is: the most savvy companies contract annual sitewide pentests, in addition to all the other stuff they do to secure their networks, and virtually all of those pentests "succeed" (from the perspective of the testers). Further: not only have I never personally been on an internal network pentest (the kind where you start with an IP "behind the firewall" and nothing else) that failed, but I'm not sure I've even ever heard of one that failed. I'm certain there are some networks that are so resilient that they've stymied a competent internal pentest --- but again, I wouldn't know which one, because I've never heard of that happening.