u/cirocobama93

We had a finding last month that we had roughly 500 SQLi vulnerabilities across our apps which an AI scan ran by VM identified. My CISO was copied on the results of the scan and said essentially “SQLi bad, track with a finding for enhanced visibility”. My VP agreed even though we have a fully separate vulnerability tracking process in service now where normal vulnerabilities get fed into track.

Once entered, our PMO team and VM teams said they were too busy to track and validate the remediation so they wanted us to manage throughout the process and let VM know once all teams have attested to remediation then they can rerun the scans. My VP signed our team up for the project management efforts of this whole process

Now I’m stuck with dozens of different POCs asking me the specifics of how they should fix their code. I sent the first few to VM with my recommendation asking them to confirm my suggestion but they’re ignoring me or taking weeks to respond. I escalated this to my VP and she’s just telling me to tell the app teams to use Cursor to figure out the solution.

On top of this, I’m supposed to manage a tracking file for what’s fixed but I don’t have GitHub access, got denied a GitHub license, and app teams are buried in work and also ignoring me so I’m having to send 2-3+ emails to each POC to even get some semblance of a response.

To be honest this sucks ass. I don’t feel this is the role of GRC, I think we’re supposed to provide oversight and requirements, not get into the PMO aspect of driving every step of the remediation.

Fortune 500 financial services company for context.

What’s the extent that you all get involved in tracking actual remediation work? Is this par for the course or an overreach of our responsibilities?

how do other GRC teams distinguish between a security exception and a finding/control deficiency?

Let’s sat an application legitimately needs an HTTP connection to a legacy service in order to function, but our policy requires HTTPS. Security Architecture approved an exception for a period of time, with the expectation that the legacy service will eventually be retired. In our environment, once an exception reaches 6 months, the exception team will no longer renew it and expects the issue to come through my GRC team as a finding so that it gets enhanced visibility and tracking. We’ve historically created hundreds of findings created this way.

We recently started getting pushback from new Risk Management leadership (outside tech) that these shouldn’t be findings because there is no control failure. Their rationale is the control is operating as designed, the requirement is that connections use HTTPS, and the organization is knowingly allowing an application to operate outside that requirement, so it’s a security exception.

The problem we’re running into is that if the exception expires and Risk won’t accept it as a finding, teams end up with a known risk but no active exception or finding to track it. This is holding up teams from releasing or migrating and GRC is stuck getting the blame.

How do other organizations handle this? Do you treat an expired/unacceptable security exception as a finding even when the control isn’t considered failed? Do you have a separate mechanism for these situations?

This is accomplished by:
- risky skipper (getting 2 patches) + 0 drop
- risky skipper and coining another 1-drop
- any 1 drop and coining ominous nightmares

I’m not sure if I’m losing tempo, but I’ve been finding killing the patches to be more successful. I found leaving the Patches alive usually at least 1 gets removed before my next turn and it usually takes another turn to get the warpteeth out.

For anyone curious this is the deck, just popped up with the xpac:

### Cute Warrior
# Cost: 9000
# Format: Wild
# ⬜ 2x (0) Ancient Totem
# 🟦 2x (0) Target Dummy
# 🟪 2x (1) Adaptive Amalgam
# 🟪 2x (1) Mistake
# ⬜ 2x (1) Ominous Nightmares
# 🟨 1x (1) Patches the Pirate
# 🟦 2x (1) Risky Skipper
# ⬜ 1x (1) Shield of Honor
# ⬜ 2x (1) Treasure Distributor
# ⬜ 2x (2) Jam Session
# ⬜ 2x (2) Parachute Brigand
# 🟪 2x (2) Roaring Applause
# ⬜ 2x (3) Imbued Axe
# ⬜ 2x (4) Light of the Phoenix
# 🟨 1x (4) Warptooth
# 🟪 2x (5) Tent Trasher
# 🟨 1x (8) Chainbreaker Hogger
AAEBAQcEkbwCkdAD69YHstgHDY0Q6bADpLYDxN4D/9sEj5UFlaoFtNEF9PIFovoF/KgGltMGtI8HAAA=
# You can view this deck at https://www.hsguru.com/deck/40671718

Mainly just need to vent but curious if others have experienced vets / emergency centers being nonresponsive or having to pry updates out of them?

My dog is currently spending at least 24 hours at the emergency vet for a potentially fatal raisin poisoning. This emergency vet is 4.7 stars and seemed highly accredited.

I dropped her off at 7am and they got her on an IV and said they’d provide an update by 2pm and 7pm. I heard nothing by 4pm so I called and they said she’s fine, resting, but they haven’t been able to run her next test yet. She said they’d run it right away and give me a call in 30 minutes.

By 6 I heard nothing so I called again twice and nobody’s answered. Now it’s past 7 so I’m assuming the head vet has left.

I understand they’re probably having a busy day but now I’m getting zero meaningful updates today. Even a 10 second “results came back fine” is all I am looking for.

Am I being unreasonable to expect updates from the emergency vet watching my dog with a potentially fatal condition? Is it worth trying to keep calling until somebody answers?

At this point is it crazy if I go down and ask in person?

Edit 7/8: My dog is all good! The IV bag did its magic. Going to pick her up this morning. Thanks for all the honest feedback

Only posting because it’s on the tip of my tongue and I can’t remember this guy’s name. There was a dude about 5 years ago that everyone clowned on saints twitter because he always claimed to have inside sources but was always wrong

I remember all of saints twitter especially datboywolf and Bayou Bun clowning him around the 2021 season because of something I can’t remember either but it was the talk of the timeline that day

I remember him pivoting after that day into being all about positivity and trying to make everyone feel bad

This post is really pointless but it’s going to bother me if I can’t think of this guys name

Edit: it was Nader Mirfiq. He posted some racist nonsense back in March 2021 which was the event I was thinking of.

So much of this game feels like a knowledge check on shit I did hours ago in game time. I now have a lifelong beef with the hookshot to the point it’ll probably transfer over to legend of Zelda. I don’t understand how you’re supposed to beat this game first try without using a guide