News for hackers. Stuff that matters.

A comment on Bypassing airport security via SQL injection. Parent comment

Re:Bypassing airport security via SQL injection by kva-gad-fly on Thursday August 29, 2024 @05:57PM (#41395701)
Even if these govt. security audits are checkboxes, dont they require some nominal pentesting and black box testing, which test for things like SQL injection?

That shoudl have caught these types of exposures?

[ Parent | on HN ]
Re:Bypassing airport security via SQL injection by lvturner on Friday August 30, 2024 @05:50AM (#41399197)
It may not apply to this specific incident, but pen-testing only ensures you meet a minimum standard at a specific point in time.

I almost feel I could write novels (if only I had time and could adequately structure my thoughts!) on this and adjacent topics but the simple fact is that the SDLC in a lot of enterprises/organizations is fundamentally broken, unfortunately a huge portion of what breaks it tends to occur long before a developer even starts bashing out some code.

[ Parent | on HN ]