Re:Two top Equifax execs to retire after security breach
by kibwen on Friday September 15, 2017 @07:21PM
(#15261665)
> The very next commit could make that pentest obsolete. Ditto for spinning up a server.
This is addressed by "vigilance". And no, we still aren't asking for perfect security. Even on human-scale timeframes, the odds of a single exploitable vulnerability being introduced in any aspect of the software, for even a moment, are 100%. But if it takes only a single vulnerability to completely exfiltrate the whole of a company's sensitive data, then you're going to be hard-pressed to find anyone calling that a securely-designed system. I'm sincerely sorry that a career spent in the trenches has left you so jaded and cynical, but we can do better, and hopefully we as an industry do so before the government looks at our inability to self-regulate and imposes double-secret-hyper-SOX on all of us.
This is addressed by "vigilance". And no, we still aren't asking for perfect security. Even on human-scale timeframes, the odds of a single exploitable vulnerability being introduced in any aspect of the software, for even a moment, are 100%. But if it takes only a single vulnerability to completely exfiltrate the whole of a company's sensitive data, then you're going to be hard-pressed to find anyone calling that a securely-designed system. I'm sincerely sorry that a career spent in the trenches has left you so jaded and cynical, but we can do better, and hopefully we as an industry do so before the government looks at our inability to self-regulate and imposes double-secret-hyper-SOX on all of us.