3 ms·

"management gave us no choice" - Would you have done differently? "The only way we could show clients a passing pentest..."

• cnity 3y ago
  Push back on the pentest firm and explain reasoning, rather than bubbling pointless requirements to the engineers.
  • Kalium 3y ago
    That might work if your company hired the pen testers, it's a lot less likely to work if they were hired by a client. In the latter case, the overhead of all the required explanation and smoothing of ruffled feathers for the client likely costs a lot more than implementing the stupid timeout in the first place. Pen testers are often very resistant to pushback. They get it a lot, and usually on things that are real concerns.
    • cnity 3y ago
      Good points.