Re:Bypassing airport security via SQL injection
by sandworm101 on Thursday August 29, 2024 @02:35PM
(#41393941)
They do. But market forces have pushed the standards down. Once upon a time a "pen test team" was a bunch of security ninjas that showed up at your office and did magic things to point out security flaws you didn't know were even a thing. Now it is a online service done remotely by a machine running a script looking for known issues.
[ Parent
| on HN ]
Re:Bypassing airport security via SQL injection
by advael on Thursday August 29, 2024 @03:35PM
(#41394507)
Unfortunately we're in kind of the worst of all possible worlds here too. Not only do we want to "automate" these kinds of tests, but governments have bought into the "security through obscurity" arguments of tech giants, so the degree to which these automations can even be meaningfully improved is gated in practice by whoever owns the tech itself approving of some auditor (whether automated or human) even looking at it. The author of this article takes the serious risk of retaliation by even looking into this