4 ms·
> "we did pen testing when we launched, but haven't done it since". Well… was it before you joined the company? You tell them in that case that was before you
by rq1 3y ago
> "we did pen testing when we launched, but haven't done it since".
Well… was it before you joined the company?
You tell them in that case that was before your time and you quote your boss.
I’m not sure why you replied no to begin with, if you didn’t know. You should have asked your boss about it first and take his word.
During the zoom call, you can simply reply that your boss told you so and ask him to produce the old report if it’s still in his possession.
Anyways I think these tests (iso 27001) should be held regularly to mean anything.
Being compliant in 2021 doesn’t hold the same “level of guarantee” in 2023.
And that last part is up to your client’s policy.
Do they need a recent third party audit or whatever… you should ask them questions and check with your boss if it’s worth the spending.
- lolinder 3y agoNowhere does the author say they were unsure whether it had happened: > I, truthfully, wrote that we had never pen tested our software. ... They provided me with an answer to the pen testing question that essentially said "we did pen testing when we launched, but haven't done it since". I made sure they were aware that this wasn't true. Three years into a job as the most senior technical employee, I'd expect him to know if there were any pen tests done before he joined. It sounds to me like this is a pretty garbage company, where the one developer with a clue feels like he has no agency. I believe him if he says they didn't do any pen testing before he was there.