Adventures in Vendor Security and Continuous Review
summary
Builds a continuous vendor-review pipeline that scans public sources daily and cross-checks them with any available SOC 2 or pen‑test evidence, claiming work on 150–200 vendor reviews and aggregation from 20–25 external scanners. Uses SSL/TLS scans (caught SSLv3 persisted for a year), mobile app scanners like HD‑Bridge and NowSecure, IP reputation and breach feeds, and an internal scoring engine that flags mismatches, reduces questionnaire load, and still wrestles with false positives and engineering debt.
AI-written summary · about
chapters (12)
- 0:00Introduction to vendor security
- 1:44Evolution of third-party cloud providers
- 3:50Traditional assessment methods
- 6:44Limitations of point-in-time reviews
- 8:50Continuous review using recon methods
- 12:29Mapping resources to security categories
- 14:17Mobile app vulnerability scanning
- 16:48Balancing free and premium tools
- 18:37Pre-assessment monitoring benefits
- 20:23Challenges of recon-based approach
- 21:05Call to action for security professionals
- 21:47Future of vendor security portals
related talks
29mVendor Security: Where Our Data Goes We Follow
40mIs Your Code Secure?: Automatic Security Analysis Tools and Systems
42mContinuous Security: Integrate security tools into your DevOps Pipeline
01h 01mDefendable Products: How we try to improve security in our products
36mThe Road To Being Rugged
33mBattle Tested Application Security
52mApplication Security at DevOps Speed and portfolio scale
26mBuilding and Verifying Security Trust in Today’s Complex Tech Stacks ...