I basically said it was bullshit, pointed out that this was not industry best practice, and that we weren't storing any sensitive information.
The meeting ended quickly (and it became clear that the auditors were full of hot air.)
- auditors which commonly "pass" things which should be flagged, but happen to be a more expensive then normal industry standard in ways which should make them non-competive but somehow they get hired a lot
- auditors which flag nonsense and don't understand anything about security at all
some of the "security frameworks" which are applied by default makes a lot assumptions about how software is build/structured/works _based on what was common in the 90th_, and they don't even list their own assumptions... Luckily they are a base line you can perfectly fulfill but still a pain.
Like e.g. a session key having 128bit entropy is a reasonable minimum, but then imagine the framework assumes the session key & session id are the same because some 90th software did so and now requires you session ids to have 128bit entropy, but e.g. UUIDv4 has only 122bit entropy and a UUID being used is deeply integrated into middle-ware you use and can't be changed... (And having a session id=session key setup is anyway a bad idea as it means you mustn't log the session id anymore, but you also might have requirements which do require logging session ids in audit logs and similar).
This isn't even the most nonsensical thing I had ran into, just one I remember well. There where rules based on assumptions of you uploading files into a file system _using the upload file name_ while interleaving security sensitive web-server config files with uploaded directories ... like yes I know some software did so in the past but the rule should be "your software musn't do such a negligent thing" and not "you software must do this 5 extra steps in case it maybe does that insane negligent thing"
When you work in a regulated industry, you have to get pentests. The pentesters come with a list of "recommended best practices" to harden / secure your apps, which include all of the bullshit you mentioned.
It's a finding if they're not implemented. Even if the dev team doesn't want to implement these things they get forced to by policy and the overall process :/
You'd have to find someone quite senior to sign off on the risk and who would fight vigorously against the cyber/policy teams for basically no benefit to themselves. They would also have to be super pro freedom and highly technical to even understand the issues, which is not the personality profile of the kind of executive who ends up with overall authority over a bank's mobile app.