by Serguey Shinder
We booked the security test for the sixth week before launch, on a build that had been running for fourteen months. The honest reason for that date was that a customer's contract required a report, and the sixth week before launch was when a report could exist without delaying anything.
Twenty one findings came back. Seventeen we fixed inside a week, and they were the kind of thing that takes a week. A missing header. An error page that named the framework and its exact version. A dependency four releases behind. An endpoint with no limit on how often a stranger could ask it. Two were informational. Two were architectural, and two years later one of them is still open.
The first was that our audit log was written by the service that performed the actions, into the same database, using the same credentials. Anybody in a position to act in our system was in a position to edit the record of having acted. The second was our signing key. Roughly three hundred customers had configured their integrations with a value we had issued in the first month of the project, and changing it was not an engineering task at all. It was three hundred commercial conversations and a coordinated cutover, which is why we have not had it.
Both of those were decided in the second month of the project, at a whiteboard, in conversations that lasted minutes, by people who included me and who were not thinking about either question. The audit log wanted a second set of credentials and somewhere to write that our own application could not reach. The key wanted a scheme where each customer holds their own and can be moved one at a time. Both are an afternoon at the start and an unfinished programme at the end.
What the test could buy us in week fifty eight was paint, and a ticket. Every finding it could act on was a finding that lived in a file rather than in the shape of the thing.
So we changed when we ask rather than how thoroughly. Before anything is built now we spend an hour on three questions. What can somebody do to the record of events if they reach the thing that creates them. What would it actually take to change every secret in this design, and who else has to move. And which decisions here would require a customer to do something if we ever needed to undo them.
The habit that came with it is a column in our findings sheet, and it is not severity. It is the earliest week in which this could have been found. The average of that column is the only number I have that describes our security work rather than our security report.
– Serguey Asael Shinder
Leave a Reply