PagerDuty's Security Training for Engineers

Disclosure

Responsible disclosure plays a crucial role in cybersecurity by managing vulnerabilities efficiently. Joe Zack explains that when a security researcher discovers a vulnerability, the company typically has 90 days to address it before the researcher releases the information publicly. This period allows companies to mitigate risks and develop patches, but it also highlights the importance of not relying solely on frameworks to handle security issues 1. Michael Outlaw emphasizes the need for proactive measures, such as sanitizing inputs and using open-source tools to stay informed about potential vulnerabilities 1.

   

Framework Risks

Relying solely on frameworks for security can be risky, as highlighted by Alan Underwood. He warns against the misconception that frameworks handle all security concerns, citing the example of a zero-day vulnerability in Grafana 2. Joe Zack adds that while frameworks like Dapper can help parameterize queries, developers should not entirely depend on them for input sanitization 2.