6 ms·
> Where I work, we use Chexmark and Whitesource to scan for vulnerabilities. Umm... that has little to do with security? You may or may not understand, but sec
by lmilcin 5y ago
> Where I work, we use Chexmark and Whitesource to scan for vulnerabilities.
Umm... that has little to do with security? You may or may not understand, but security is a process and those tools are but small parts of that process.
If security could be guaranteed by tools like the above how are we still hearing about security issues at all?
- drewcoo 5y agoSecurity turns out to be an abstract concept. That might still be useful but too many people keep swapping their own definitions in place of others and proceeding as if we're all talking about the same "security." We commonly hear more about "security snake oil" than snake oils of performance (also slippery to define) or usability (another definitional minefield). Why? I think it's because security fits into the Bermuda Triangle of: 1. loose terminology (that we all argue about) 2. no obvious, casually noticeable effect 3. unknown but real risk The same as UFOs, psychic phenomena, deities, etc. And we have an industry built around maintaining that mystique.
- IncRnd 5y agoOn the contrary, I have found security to be very well defined. Do you have an example for any of those statements labelled 1-3?
- b3morales 5y agoI agree, but I think this ties in to the comment above that "management only cares about what it can assign numbers to". A Chexmark report has a punchlist of specific items paired with priorities. This is perfect (leaving aside the issue of the quality of the report) for making the problem concrete to management. And it lets them feel useful by saying stuff like "okay, we don't need to address any of the 'warnings'".