3 ms·

This hits home for me. Two cases leap to mind. Infosec team ran regular vulnerability scans and flagged our Go code as having a violation of some .net specific

This hits home for me. Two cases leap to mind. Infosec team ran regular vulnerability scans and flagged our Go code as having a violation of some .net specific bug. They requested we fix it. Literally nothing to fix and no teams ran .net anything. Another time, the security team discovered a bug in some open source MTA (mail transfer agent; email sending) and multiple times insisted we implement a fix. We didn't use that software. Worse than that, our company only existed because we wrote our own MTA, it was our core service and reason for existing. At one point, a knowledgeable security expert was worth something. Now it seems to be checkbox driven.

MattPalmer1086 4y ago
Your security team is either incompetent or made powerless themselves by unthinking compliance tick box people. And frankly I'd go with incompetent as they should be able to make a risk argument that there is no risk! I have heard similar stories from other people I know. There is unfortunately for business an acute shortage of good security people. This works well for me of course, as I find myself in demand :)
silvestrov 4y ago
There is an even worse scenario if you try to stop brute-force hacking of product URLs: When you have received a number of invalid URLs from an ip address then you shadow ban the ip address by sending "404 not found" back for ALL following requests from that specific ip address no matter if it requests a valid URL. Now all the security checking is skipped because simplistic security testing looks like "yet another hacker".
- sethammons 4y ago
  Ha, yup. We had metrics for any endpoint that was attempted and we got paged for zounds of 404s being generated. We thought it was an attack and reached out to our infosec team. "We are scanning for vulnerabilities." They wouldn't stop the scans so we had to stop alerting on 404 spikes. After, we have no way to detect an actual nefarious scan. Yay checkbox driven compliance.

MattPalmer1086 4y ago

Your security team is either incompetent or made powerless themselves by unthinking compliance tick box people. And frankly I'd go with incompetent as they should be able to make a risk argument that there is no risk! I have heard similar stories from other people I know. There is unfortunately for business an acute shortage of good security people. This works well for me of course, as I find myself in demand :)

silvestrov 4y ago

There is an even worse scenario if you try to stop brute-force hacking of product URLs: When you have received a number of invalid URLs from an ip address then you shadow ban the ip address by sending "404 not found" back for ALL following requests from that specific ip address no matter if it requests a valid URL. Now all the security checking is skipped because simplistic security testing looks like "yet another hacker".

sethammons 4y ago
Ha, yup. We had metrics for any endpoint that was attempted and we got paged for zounds of 404s being generated. We thought it was an attack and reached out to our infosec team. "We are scanning for vulnerabilities." They wouldn't stop the scans so we had to stop alerting on 404 spikes. After, we have no way to detect an actual nefarious scan. Yay checkbox driven compliance.