2 ms·

Remember that the goal of most security/procurement questionnaires isn’t _security_ … it’s _conpliance_ Compliance is not security. For buyers, they often jus

by cj 3y ago

Remember that the goal of most security/procurement questionnaires isn’t _security_ … it’s _conpliance_ Compliance is not security. For buyers, they often just need to check a box so that they can maintain their own compliance obligations. They probably don’t care all that much about your security if you can check all the boxes. Pen tests are a joke. You can get perfectly acceptable pen tests (from compliance perspective) done for $2k in less than a week and the testers will try to find a couple things but their goal isn’t to evaluate your app’s security. Their goal is to make you happy with the report you’re paying for (and you won’t be happy if it has a list of 100 security bugs) Note: I don’t like that this is how compliance works. I wish compliance were more closely tied to security. But that’s simply not reality.

catiopatio 3y ago
You’re attempting to justify lying on the basis of “I can decide whether the customer actually cares about the truth” In the process, you're reinforcing all my negative perceptions about the (non-existent) ethics of sales staff.
- cj 3y ago
  I’m not justifying anything. I’m just communicating the reality of how security, procurement, and compliance works in the real world. See the note in the original comment: > Note: I don’t like that this is how compliance works. I wish compliance were more closely tied to security. But that’s simply not reality.
  - catiopatio 3y ago
    Unethical people commit fraud in the real world. Ethical people don’t. The original advice was that such “embellishment” was normal. My response is that it’s only normal to unethical people.
mvdtnz 3y ago
No. Other readers, please do not take the above post as true. It absolutely isn't and it's a very good way to get yourself into very hot water.
eschneider 3y ago
Sure it's about compliance. In the event of a problem followed by a lawsuit, how comfortable would you feel explaining to a judge that you falsified the compliance forms? If the answer isn't 'completely comfortable", you probably shouldn't go around falsifying compliance forms.

by cj 3y ago

catiopatio 3y ago

You’re attempting to justify lying on the basis of “I can decide whether the customer actually cares about the truth” In the process, you're reinforcing all my negative perceptions about the (non-existent) ethics of sales staff.

cj 3y ago
I’m not justifying anything. I’m just communicating the reality of how security, procurement, and compliance works in the real world. See the note in the original comment: > Note: I don’t like that this is how compliance works. I wish compliance were more closely tied to security. But that’s simply not reality.
- catiopatio 3y ago
  Unethical people commit fraud in the real world. Ethical people don’t. The original advice was that such “embellishment” was normal. My response is that it’s only normal to unethical people.

mvdtnz 3y ago

No. Other readers, please do not take the above post as true. It absolutely isn't and it's a very good way to get yourself into very hot water.

eschneider 3y ago

Sure it's about compliance. In the event of a problem followed by a lawsuit, how comfortable would you feel explaining to a judge that you falsified the compliance forms? If the answer isn't 'completely comfortable", you probably shouldn't go around falsifying compliance forms.