Hacker News Reader

They can be held to a much higher standard than this - a system that can leak all the sensitive data due to an error in the web app. You are describing an amateur architecture where there is a web app directly communicating with a database of sensitive information, and that web app has full access to the database. No experienced developer would do that.

View on HN

And what would they do?

Everyone either goes silent or describes an idealized architecture that has glaringly obvious flaws in regards to meeting business goals.

I think maybe the top ten companies in our industry do this at scale well enough to work. Maybe.

1) keep an asset register up to date. This would include libraries used.

2) subscribe to a service that alerts on vulnerabilities in the assets listed in 1). Run Nessus scans. License cost you a bit over $1k a year.

3) invest in a resource to maintain the register and respond to alerts. Tie them into a governance model so management are aware of risks and can divert time and money when needed to mitigate

Security is a process not a technology. Nothing I've mentioned here is sexy or advanced.

Reply on news.ycombinator.com