4 ms·
As someone who works in security and deals with these questionnaires a lot, I don’t have any idea how they caught on. It is my opinion that they mean nothing an
by lawnchair_larry 6y ago
As someone who works in security and deals with these questionnaires a lot, I don’t have any idea how they caught on. It is my opinion that they mean nothing and are worth nothing.
Asking how a company’s development practices protect against the OWASP Top 10 doesn’t make a lot of sense. The top 10 isn’t a static list, nor is it backed by any real data, and many of the entries are fairly generic concepts that aren’t something that can be addressed holistically with any particular development practice.
Everybody lies on these. They’ll just say a best practice, or they’ll quickly run a scanner in response to the question, or they give you the policy that no one actually follows, or they’ll give a partial truth, like saying that they use 2FA, when they only use 2FA in some places, etc.
Every company you hear about getting hacked had great answers on their security questionnaire. I guarantee that Equifax had a policy of patching vulnerabilities for example. These are just paperwork that wastes everyone’s time.
Certifications like SOC 2 are even worse, but they sure do make some people a lot of money.
- KirillPanov 6y ago> I don’t have any idea how they caught on. Probably the lawyers asked for it. As in, if $VENDOR gets hacked and we did no due diligence, we are definitely liable for $VENDOR's incompetence. If we can prove we attempted some form of due diligence, with a paper trail, we might have a fighting chance.
- McCaffery 6y agoTotally agree with you. However, in my head it was, "hey lawyer, what should we do to protect ourselves against breaches by our vendors?" Lawyer thinks, well, we do due diligence for M&A, financings etc. etc. so why not for onboarding vendors. Course, now this process is codified into law. I have an idea for a better way... :)
- lawnchair_larry 6y agoThe thing is, lawyers aren’t asking for these. It’s mostly security bureaucrats who approve software purchases or SaaS agreements. Someone will say, how are we making sure that we can trust our vendors? Someone else will say, lets hire someone to put in charge of making sure we buy the right things. Someone who claims to be a security expert. A “security expert” says, we will ask them for their audit reports. As an expert, I will read them and tell you if they are secure. It’s just paper pushing.