19/06/2024
.secure.ity_podcast on https://www.twitch.tv/jlafanatic
Had a great time hanging with friends and talking about cyber security stuff. Tonight's topic was security testing in production versus testing in a lower environment such as dev, uat, qa, pre-prod, or other wacky names we've come up with.
While there exists all kinds of nuance and guardrails (watch the podcast for all the important details), the conclusion is that ultimately testing in production is necessary.
In production your system is under constant attack from external bad actors. If the system can't handle a sanctioned and known pentest, how is it going to handle the constant barrage of attacks thrown at it?
Production is also the only place that your customers interact with. If you want to be 99.9% certain a vulnerability is mitigated, that validation must be done in production (again, some nuance here from the podcast).
As usual, stay secure and stay connected.
