3 ms·
In "What Happens if a Third Party is Compromised?" they mention you cannot revoke an attestation once it's committed. What happens if a security audit is conduc
by totony 5y ago
In "What Happens if a Third Party is Compromised?" they mention you cannot revoke an attestation once it's committed. What happens if a security audit is conducted, concludes, but a vuln is found a few years down the line?
Security audits are not perfect. Is there a way to say "new information has come up, and this version is no longer secure?"
Even with perfect security audits such a feature might be useful, e.g. when you conducted a security audit, but new SPECTRE-like attack vectors are found.
- CiPHPerCoder 5y agoYes, it's called a timestamp. Revocation of trust here isn't automated. "I just greenlit ransomware" is a very different category than "Attacks got better, as they do".
- totony 5y agoHow do you know a timestamped vouch is no more valid? Isn't that the point of revocation?
- CiPHPerCoder 5y agoIt's not about "valid" or "no more valid". It's about context. If you want to distrust a security vendor for greenlighting something that was found to be vulnerable the following week, you'd probably be in the clear. If it was 6 years ago? Maybe don't count that against them; especially if it's a novel vulnerability that was discovered. But also, if you're running 6 year old software, maybe update to a newer version of it.