3 ms·
Part of the point of the audit would be to demonstrate that you take it as seriously as you say you do. Not so much to check the fine details.
by hdfbdtbcdg 7y ago
Part of the point of the audit would be to demonstrate that you take it as seriously as you say you do. Not so much to check the fine details.
- shereadsthenews 7y agoI don't personally put any value in those kinds of audits but Google has those. For example they have outside auditors for SOC and ISO 27018 and whatnot. Some dipshit from Ernst and Young swears that Google has such internal controls and processes.
- scarface74 7y agoIn other words, it would be the same type of theater that most companies engage in. I know plenty of companies with "strict security standards" administered by the infrastructure department so they can pass an audit or some other type of security compliance. But most security breaches happen because of badly written software that the "compliance department" never reviews and they wouldn't know what to look for if they did. Developers could have: sql = "Select * from Foo Where FirstName = '" + firstname + "'"; All over their code and no one in "compliance" would be any the wiser.
- eitally 7y agoThis isn't necessarily true. At my previous company we had a serious finding (DoD audit) as a result of poorly written software. The finding was discovered by running one of our standard internal reports and looking at who touched what, when, and where. Pretty straightforward, and although the fix was in code, the discovery didn't require any technical analysis.
- scarface74 7y agoWithout going into confidential information, how could a report that didn’t analyze the code find possible sql injection attacks or over posting vulnerabilities?