3 ms·
They can be held to a much higher standard than this - a system that can leak all the sensitive data due to an error in the web app. You are describing an amate
by jacobsenscott 9y ago
They can be held to a much higher standard than this - a system that can leak all the sensitive data due to an error in the web app. You are describing an amateur architecture where there is a web app directly communicating with a database of sensitive information, and that web app has full access to the database. No experienced developer would do that.
- sillysaurus3 9y agoAnd what would they do? Everyone either goes silent or describes an idealized architecture that has glaringly obvious flaws in regards to meeting business goals. I think maybe the top ten companies in our industry do this at scale well enough to work. Maybe.
- sasas 9y ago1) keep an asset register up to date. This would include libraries used. 2) subscribe to a service that alerts on vulnerabilities in the assets listed in 1). Run Nessus scans. License cost you a bit over $1k a year. 3) invest in a resource to maintain the register and respond to alerts. Tie them into a governance model so management are aware of risks and can divert time and money when needed to mitigate Security is a process not a technology. Nothing I've mentioned here is sexy or advanced.