3 ms·
Years ago I worked as the project lead on a legacy enterprise web application that had been running for a number of years prior to my taking over. This was a la
by ajxs 4y ago
Years ago I worked as the project lead on a legacy enterprise web application that had been running for a number of years prior to my taking over. This was a large financial organisation, and we were governed by considerable amounts of regulation. The decree had been handed down from high up on the mountain that every year we were to submit the application to a security audit from <unnamed consulting bodyshop>, in addition to a more comprehensive pentest from actual professionals. The security audit consisted of the consultants running a series of scripted HTTP requests against our application checking for the existence of unsecured —or accidentally deployed— resources, such as /.git/... or /.svn/... or similar. The revolving cast of front-end developers who had contributed to the project had been guilty of numerous sins, but one galling sin in particular was that when a valid route could not be resolved by the Redux router, the front-end returned a '404' page with a '200' HTTP status. The first year this happened I ended up being buried under a mountain of paperwork having to explain to all kinds of pointy-haired people why we hadn't actually spectacularly failed our security audit when every kind of SVN artifact imaginable by the consulting firm was marked as existing.
- cjonas 4y agoClassic... I'm working on a project with similar regulations. I'd almost guaranteed the front end does the same and is going to get checked by a similar set of scripts at some point. Thanks for the heads up
- wiredfool 4y agoWe were dealing with a pen test on a static site, cloudfront backed up by s3. We hadn’t set up a special rule for the not authorized -> 404, so the tester flagged a whole bunch of “privileged” urls returning unauth and it being a disclosure issue. /admin, /.got, and so on.
- cjonas 4y agoWe have the same setup (except azure front door and blob storage). Secops is about to start using some automated pen testing tool... Hopefully I have time to get the team in front of it before I end up getting assigned hundreds of issues and angry emails.
- ozim 4y agoOh wow just felt the pain reading this. I help filling in compliance excels when we get a new customer - explaining that "it does not work that way and 80% of this is not applicable to our systems" 10s of times.
- ethbr0 4y agoGiven a choice between understanding "why red" and it being re-marked as "green", management will prefer the latter every time.
- bornfreddy 4y agoIf you have the trust, it helps (ime) to drop hints that the auditors are not very knowledgeable / are giving false alarms / are taking the easy way instead of really checking the systems. Such automated tools are meant to be operated by someone who understands the technology. That said, there is probably some API you use, they should be checking that instead.