upvote

points

by xKingfisher23 hours ago |
comments
upvoteby kobieps13 hours ago|
next
[-]
From personal experience having worked with multiple "enterprise-grade" pentest vendors (including NCC), I think the entire pentest industry is overdue for a big shake-up.
reply
upvoteby hintymad11 hours ago|
prev|
next
[-]
> TiDB, the open-source distributed SQL database powered by PingCAP, today published the results of a rigorous source-code security assessment by NCC Group, one of the world’s leading cybersecurity consultancies.

It looks like you can assess the hell out of your source code, but your system can still leak if you don't secure your operations.

reply
upvoteby somat2 hours ago|
parent|
[-]
There was a quote from back in early web days that has stuck with me, Still relevant today.

"good opsec will save you from bad crypto. but the converse is not true, good crypto will not save you from bad opsec"

reply
upvoteby jacquesm5 hours ago|
prev|
[-]
No particular opinion on NCC but a lot of that stuff is pay-to-play.
reply
upvoteby mogwire23 minutes ago|
parent|
[-]
I don’t think people truly understand how bad it is.

15 years ago I helped do a PCI/SOX compliance evaluation for a company looking to go public.

They had PWC in there with kids fresh out of college, no computer experience, and they would sit at the desk with the admins and say, “show me your Active Directory password policy”. Ok, looks good. CHECK

Why don’t you have this configured? I’d hear an alarming bullshit reason. Ok, we can exempt that. CHECK

I could go on and on and on with how bad it was.

And they bragged to potential investors. We are PCI/SOX complaint.

reply