New answers tagged

0

The SaaS offerors are not likely to agree to let you pen test their services. They might agree to independent testing but the testing frameworks are not likely to be comparable. So you will be hard-pressed to compare the findings by one to that of another. Unless you are soliciting $1B in business, perhaps FedRAMP certification is the best you can hope for. ...


3

In a SaaS model, you will likely not be able to perform code audits. This is because as stated, it is Software as a Service. Not software where you would be able to download the software itself, let alone the source code for the software. That task would be done at the discretion of the software vendor, and or provider. Please see "5 Problems with SaaS ...


1

I can think of following scenarios: Safety against SQL injection and login related attacks if your software has user accounts The accuracy and robustness of your access control if your software has users


0

Redhat provides the necessary CVE to package version information. For any provided CVE the package version may (and as I have found in my own experience) may not correspond to the original package version. Example source from developer for package ABC is v0.0.3 which addresses CVE 1.1 where RedHats RPM of ABC is at v0.0.2x for release 6 and at v0.0.3 for ...


1

Providing the SA and version should be good enough since the SSH patch has been implemented. If they have problems with this then they would have to take it up with Redhat version control themselves. After all if you can demonstrate that the attack will not work because it has been patched, version number means nothing. It's already patched regardless of ...


0

What you need to address is the issue, and whether or not the issue is fixed, or if there is a compensating control to address the vulnerability. If there isn't a patch for a vulnerability, you would be out of compliance however if you had rules that illustrated that you blocked all, but allowed only trusted (vetted sources) you now have a compensating ...


0

Taken from the book, CyberWar, CyberTerror, CyberCrime and CyberActivism, 2nd Edition ISO/IEC 27003 (the ISMS default-suggested by ISO 27001), provides practical guidance for implementing a security management system based on ISO/IEC 27001:2005 by introducing a comprehensive methodology of applying the PDCA cycle to cybersecurity. This standard ...


1

Samba usually refers to the *nix implementation of the SMB protocol. Basically, it means you have a machine that is either directly connected to the net or has it's IP forwarded in your firewall and that has file or printers sharing enabled. Whether that service can be remotely exploited (in any way) depends a lot on what's your actual setup it. However, ...


2

To add to Xander's answer, there are a few things to consider: Company policy IaaS, PaaS, and SaaS multi-tenancy Key management Current internal security posture Company policy Some companies are okay with *aaS, some companies say a certain level of PII is okay to store off-prem without encryption, or require encryption for a certain level, and say ...


17

Given the current state of public cloud, I would argue that in many cases it is in fact more secure than on-premise storage. Granted I work for Microsoft, but my opinion both pre-dates my employment, and extends to competitors like Amazon and Google as well. Companies whose business models are built on data center operational expertise and excellence, are ...


2

Should Exceptions be shown to the user? No. Displaying exception messages is bad practice. Exceptions should be used to debug the code, they should not be used to display something to the user. If you use the same mechanism - exceptions - for both tasks, it will be very difficult to separate between them. Eventually, you will either show an exception ...



Top 50 recent answers are included