It's usually stuff we catch, SQL injection (a lot), direct record access (not implement security checks against access, again, a lot), bad server configuration (TLS crypto suites, still running SSL, etc.), out of date software packages (though we can automate most of this today we sometimes have to harp on teams), bad crypto configurations (bad key lengths, broken ciphers, static initialization vectors, misused of hash algorithms, etc.).
Обсуждают сегодня