20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

Re:20GB leak of Intel data: whole Git repositories, dev tool... by maccard on Friday August 07, 2020 @05:22AM (#24080002)

I was on the receiving end of a security audit issue. I closed the bug s won't fix, my lead approved it, but when the team who paid the security auditor found out they demanded I fix it. I had to argue with it, infosec, and the auditor. Nobody really cares what I did, they just wanted to follow the rules. After a month of weekly hour long meetings I relented and changed the code.

You're often not arguing with the auditor, you're arguing with the person who paid the security auditor in the first place who is likely not even technical. That's a battle toy will likely never win.

[ Parent | on HN ]

Re:20GB leak of Intel data: whole Git repositories, dev tool... by ants_a on Friday August 07, 2020 @07:58AM (#24080941)

To add to this, often the primary goal of the person who paid the security auditor is not to actually increase security. It is to get to claim that they did their due diligence when something does happen. Any arguments with the auditor, no matter how well founded, will weaken that claim.

[ Parent | on HN ]