There doesn’t seem to be a week that goes by without news of another cyber attack. More recently, every time I see one, I bookmark it and it it into the Hacks in the Wild MoT Collection.
How do people feel about this at the moment?
What can we, as quality people, do about it?
Does anyone have stories or advice to share?
PS. feel free to add items/links to The Observatory, tag them hacks-in-the-wild and I’ll add them in periodically.
I think a key thing for us to consider isn’t just the security of our products but how we work. Using strong passwords, access control and sensible policies for our test environments and alike.
Being aware of phishing and variants is super important too.
I have a story that is public info so I’m okay to share. My old work had 2 factor authentication to log into our systems. Someone got people’s phone numbers and started messaging them random maintenance updates and advice for our 2FA system over a few months. It was just annoying spam to people but built up trust it was genuine. Eventually they then used that number to beat 2 factor authentication. Once in they had access to all source code. They then built the licensing service and issued people mega expensive licenses. (They are also in jail now).
Moral of the story… paying attention to all the annoying security policies at your work is important. Don’t work around them. Don’t be the one that brings down your company.
It’s just like the feeling that hacks are everywhere these days. Testers cannot solve everything, but they can point out the weak points early-neglecting bad defaults, careless password policies, or leftover test accounts.
What I love about Hacks in the Wild is that it brings these abstract issues in security and turns them into a story or lesson. Even some weird niche-type questions from us can help avoid large oversights.
Will someone share a security issue that has been unexpectedly uncovered during testing and would have been disastrous if it had passed?
I have worked with this the past two years - expanding testing mindset into the security realm. There are many reasons for the current buzz around the security issues. Geopolitical, consultancies buzzing, EU regulations and a general increase in buggy solutions rushed to prod.
My advice, I have already written about So sorry for self-promotion 
One thing we can do is to have an outreach mindset, as discussed here:
As Richard mentions above, this is as much about the internal tooling and procedures. There is a whole security field just around regulations and following up on those. I have previously made a guide for testers to the CIS18 guidelines. Let me share that again
Another avenue for us to explore, and one that I have had success in working in. Is to have restore/failure exercises. Be a disaster party planner!
Thanks for the reminders of what you have written, it would be nice to explore this topic somehow…gotta get TestBash out the way first.