QTDEI

Fundamentos de Segurança de Aplicações

O Departamento de Engenharia Informática (DEI) do Instituto Superior de Engenharia do Porto (ISEP), numa iniciativa conjunta com o Mestrado em Engenharia Informática (MEI), convida à participação em mais uma Palestra, desta vez sobre o tema “Security Circus in the NIS2 Era or A Case Study”, que terá lugar no dia 2 de novembro, pelas 18h, no ISEP.

O evento será presencial, na sala B201.

Resumo

I broke my own insurance provider - twice - and watched them fail to fix it. In 2025, shortly after the release of a mobile application from a well-known mid-sized insurance broker in Portugal, a security assessment conducted independently by the speaker, acting as a client and security researcher, revealed critical flaws enabling unauthorized access to arbitrary customer accounts. The issues were responsibly disclosed and partially addressed, yet the response exposed deeper problems: weak mitigation strategies, lack of secure development practices, and limited incident response maturity. Nine months later, a second, unrelated feature introduced new vulnerabilities exposing customer data without authentication. The disclosure process this time was marked by delayed responses, ineffective fixes, and prolonged exposure, reinforcing the same structural weaknesses. This talk presents both incidents as a real-world case study of organizational security immaturity. It explores how companies can repeatedly fail to learn from past mistakes, even when vulnerabilities are clearly demonstrated and guidance is provided. Framed within the recent adoption of the NIS2 Directive into Portuguese law and its promise of increased accountability at the executive level, the session challenges a common assumption: that regulation leads to better security outcomes. The conclusion is uncomfortable but necessary: compliance does not equal security. As legal protections for ethical hacking evolve and responsible disclosures increase, many organizations remain unprepared - not only technically, but culturally - to protect the data they are entrusted with.