A security researcher testing a 300-person B2B company with a global footprint discovered an internet-exposed database with weak authentication during a routine scan. The database appeared to be a prime target for attackers; it had critical severity and was an obvious first-fix candidate. Upon further inspection, however, researchers learned it was a resettable test database used to test job candidates, rather than a system containing client data. The episode represents a critical problem: Scanners and security researchers can’t infer the real cost of a compromise on their own. Increasingly...

Source: The New Stack