4 ms·

I did a website for Visa a few years ago, and it required a pentest before launch. We tried to find a loophole to justify it not needing a pentest (because that

I did a website for Visa a few years ago, and it required a pentest before launch. We tried to find a loophole to justify it not needing a pentest (because that would give us 3 more weeks to develop the site), but no luck. It was such a simple site with no database, but they required it to go through pentest anyways. The pentest came back with some recommendations. Mostly to do with the use of HTTP headers. Absolutely we fixed them, and made damn sure that the next time we had a site to be pentested those unforced errors were not repeated. So on a small scale, yes. Pentesting improved the way we developed websites. I don't know about how it affected the "culture". Visa has a really strong security culture already.

logifail 8y ago
>> Pentesting improved the way we developed websites. I don't know about how it affected the "culture". Visa has a really strong security culture already. So if the security culture is strong, the pentesters reports are read and implemented; if the security culture is weak-to-completely-non-existant, they'll likely be ignored?
- crankylinuxuser 8y ago
  > if the security culture is weak-to-completely-non-existant, they'll likely be ignored? ----> > if the security culture is weak-to-completely-non-existant, they'll likely not even be budgeted or done.