2 ms·
> "your website sends the server header which makes you vulnerable to hacking, bounty please" Getting nightmare flashbacks at my last job. My CISO insisted ev
by Sohcahtoa82 3y ago
> "your website sends the server header which makes you vulnerable to hacking, bounty please"
Getting nightmare flashbacks at my last job.
My CISO insisted everything on our penetration test report get remediated. Even "Information" level items, like the server header. And port 443 being open. facepalm
- diarrhea 3y agoIt’s a soul-sucking type of work. At my company, engineers tend to blindly follow security tooling recommendations to the T without ever considering context. Quite frustrating. One example is hardening an internal-only, ten-monthly-active-users app as if it were public. Lots of misdirected engineering hours if you ask me, but go to tick that checkbox the auditor asked for!