ISMS monthly meeting 6

Agenda: the penetration test report and the remediation plan.

Discussion: Blackharbor Security found three weaknesses that matter: an admin interface on the backup server that the customer network could reach, an injection flaw in the legacy hosting control panel, and no rate limit on the single sign-on login. The test accounts and the tracking of results to closure were discussed as weak spots on our side. Open Incidents were reviewed and none touched the scope of the test.

Decision: each weakness gets an owner and a date, and Hans Overbeek tracks them to closure. No Vulnerability is past due.