<story><title>Fintech App Switch Leaks Users’ Transactions and Personal IDs</title><url>https://vpnoverview.com/news/fintech-app-switch-leaks-users-transactions-personal-ids/</url></story><parent_chain><item><author>dvtrn</author><text>Boxes: Checked.&lt;p&gt;I&amp;#x27;ve grown a bit cynical as time goes on about this sort of stuff; not the need for the kinds of controls and checks behind SOC2, but cynical towards the lip service I continue to hear about it from the executives and leaders I find in many shops.&lt;p&gt;The &amp;quot;InfoSec&amp;#x2F;CyberSecurity&amp;#x2F;DevSecOps&amp;quot; director is often a glorified send button. &amp;quot;The SIEM said do this, send to Devops, the auditor said do this, send to Dvops, the vulnerability monitor noticed this, send to Devops, we were asked to provide evidence of this, send to Devops&amp;quot;...etc.&lt;p&gt;3 of the last 5 jobs I&amp;#x27;ve been in since 2016 have had dedicated personnel with the words &amp;quot;Information Security&amp;quot; in their job titles, and all 3 of them were really good at sending me shit to do, talking about what they read in some infosec blog, and a CVE they read about.&lt;p&gt;But here&amp;#x27;s the thing, I think I have a really good reason for this cynicism and I don&amp;#x27;t know what how to resolve it:&lt;p&gt;I don&amp;#x27;t know how confident I would be if these individuals were actually expected to build and contribute to the security effort beyond &amp;quot;send to Devops&amp;quot;, but maybe they&amp;#x27;re not supposed to? Are &amp;quot;DevSecOps&amp;quot; people expected to actually...be involved in engineering too? Or do they just sit at the periphery throwing vulnerability assessments and threat modeling work? I&amp;#x27;ve honestly only ever had the latter.&lt;p&gt;Tried having this conversation with a friend who just finished an MSc in Cybersecurity and he seemed a bit offended by my inquiry, so I dropped it...but I am still insanely curious to know because I really doubt this experience is unique.</text></item><item><author>jgaa</author><text>They are soc 2 compliant - so it must be OK ;)&lt;p&gt;I mean, they can prove on paper that they are secure. Who cares about reality any more.</text></item></parent_chain><comment><author>cmroanirgo</author><text>I&amp;#x27;ve been thinking that the problem can only begin to be addressed when security becomes a first class citizen in the complete tech stack.&lt;p&gt;I don&amp;#x27;t know of many developers, that in their day job, who pro- actively consider security. It&amp;#x27;s always &amp;quot;it&amp;#x27;s behind a firewall&amp;quot;, or &amp;quot;it&amp;#x27;s for internal purposes&amp;quot;, etc. Security practices need to be built in.&lt;p&gt;The best way I can think of to remedy this is to make university lecturers care as much about full stack security as say using goto or raw pointers or serverless or &amp;lt;insert flavour of the month&amp;gt;.
I don&amp;#x27;t think a class on security would do it either.&lt;p&gt;A good way to fast track security practices in the universities would be to have actual hackathons that attempt to breach cs and it department computers... with extra points if you can make a clown of the head of the it dept or professor of security.&lt;p&gt;It&amp;#x27;ll take a few years, I admit, but things would eventually change. I can&amp;#x27;t see any other way, other than the general populace getting so sick of this stuff that legislation would be written to heavily penalise companies that are breached.&lt;p&gt;2c</text></comment>
<story><title>Fintech App Switch Leaks Users’ Transactions and Personal IDs</title><url>https://vpnoverview.com/news/fintech-app-switch-leaks-users-transactions-personal-ids/</url></story><parent_chain><item><author>dvtrn</author><text>Boxes: Checked.&lt;p&gt;I&amp;#x27;ve grown a bit cynical as time goes on about this sort of stuff; not the need for the kinds of controls and checks behind SOC2, but cynical towards the lip service I continue to hear about it from the executives and leaders I find in many shops.&lt;p&gt;The &amp;quot;InfoSec&amp;#x2F;CyberSecurity&amp;#x2F;DevSecOps&amp;quot; director is often a glorified send button. &amp;quot;The SIEM said do this, send to Devops, the auditor said do this, send to Dvops, the vulnerability monitor noticed this, send to Devops, we were asked to provide evidence of this, send to Devops&amp;quot;...etc.&lt;p&gt;3 of the last 5 jobs I&amp;#x27;ve been in since 2016 have had dedicated personnel with the words &amp;quot;Information Security&amp;quot; in their job titles, and all 3 of them were really good at sending me shit to do, talking about what they read in some infosec blog, and a CVE they read about.&lt;p&gt;But here&amp;#x27;s the thing, I think I have a really good reason for this cynicism and I don&amp;#x27;t know what how to resolve it:&lt;p&gt;I don&amp;#x27;t know how confident I would be if these individuals were actually expected to build and contribute to the security effort beyond &amp;quot;send to Devops&amp;quot;, but maybe they&amp;#x27;re not supposed to? Are &amp;quot;DevSecOps&amp;quot; people expected to actually...be involved in engineering too? Or do they just sit at the periphery throwing vulnerability assessments and threat modeling work? I&amp;#x27;ve honestly only ever had the latter.&lt;p&gt;Tried having this conversation with a friend who just finished an MSc in Cybersecurity and he seemed a bit offended by my inquiry, so I dropped it...but I am still insanely curious to know because I really doubt this experience is unique.</text></item><item><author>jgaa</author><text>They are soc 2 compliant - so it must be OK ;)&lt;p&gt;I mean, they can prove on paper that they are secure. Who cares about reality any more.</text></item></parent_chain><comment><author>gdfgjhs</author><text>Same experience. It is so hard to have a conversation about any of the security requirements with our security team because they have no idea what they are asking.&lt;p&gt;They only know to press some buttons and then send some reports.</text></comment>