3 ms·
Push back on the pentest firm and explain reasoning, rather than bubbling pointless requirements to the engineers.
by cnity 3y ago
Push back on the pentest firm and explain reasoning, rather than bubbling pointless requirements to the engineers.
- Kalium 3y agoThat might work if your company hired the pen testers, it's a lot less likely to work if they were hired by a client. In the latter case, the overhead of all the required explanation and smoothing of ruffled feathers for the client likely costs a lot more than implementing the stupid timeout in the first place. Pen testers are often very resistant to pushback. They get it a lot, and usually on things that are real concerns.
- cnity 3y agoGood points.