5 ms·
I would go with "I was not present for any penetration testing at launch, and I'm unable to find any reports related to it. However, penetration testing done t
by tyingq 3y ago
I would go with "I was not present for any penetration testing at launch, and I'm unable to find any reports related to it. However, penetration testing done that long ago would have little current value anyway. What I will do is talk to my leaders and get regular penetration testing scheduled, and get that schedule to you asap".
- hn_throwaway_99 3y agoI wouldn't put that t exactly like that, but I would talk to the director and put something similar. Most compliance frameworks like SOC 2 have a requirement for an annual pen test, so if the pen test was over a year old it wouldn't matter anyway. Best approach would just be to talk to the director and say something along the lines of "Our next pentest is scheduled for date XYZ and we can send you those results upon completion". People who tend to freak out in situations like these where "let's lie" is their go-to, when an honest approach is possible that will likely get the job done, scare me.
- paulcole 3y ago> However, penetration testing done that long ago would have little current value anyway. What I will do is talk to my leaders and get regular penetration testing scheduled, and get that schedule to you asap". Just leave that out. No point in saying it other than to make more trouble and work for yourself.
- pipo234 3y agoThe OP sounded like he was actually interested in putting security concern's on the company's strategic agenda. So the "trouble" might be beneficial.
- tyingq 3y agoYes, the idea was to make a commitment that would then be hard to avoid. They can fire you I guess, but it's a reasonable course of action to get some pen testing in place.
- jabradoodle 3y agoOP is knee deep in committing fraud, not sure sticking it out to improve company policy is the top priority.