New answers tagged

0

Ok, so you're doing a one time pad - but it's actually a multi-time pad because the key is finite (< 100kb) and derived from a passphrase. Breaking (aka cryptanalysing) this would be fun! Here's some things I would start with: You say the key is derived from a passphrase. You don't tell us how in your question, but if I had access to your binary then I ...


1

Yes. It is relatively trivial to break this cipher without the key or passphrase being sent, given enough intercepted traffic.


0

I myself am an IT auditor. When I conduct an audit, I evaluate the sufficiency of evidence based on risk. Audit risk, the risk that a material misstatement or non compliance with rules / policy won't be found, is evaluated based on its components - Inherent risk - risk underlying process under audit Control risk - risk that faulty internal controls won't ...


1

As an IT auditor, let me give you an answer from experience. Segregation of duties - SOD It is a good practice and core principle to segregate employees who operate or administer the system from which audit logs are produced from employees such as myself, with responsibilities to review these logs for fraud / malicious activity / security vulnerabilities. ...


1

Owasp is one of the most respected authorities on information security. Here is their list of testing tools. https://www.owasp.org/index.php/Appendix_A:_Testing_Tools In regard to minimising the risk: Organisations should ensure their solution architecture takes into account the importance of information security. organisations should commission regular ...


2

There are many tools, and a few standards, but no standardized tools and a lot of the tools are expensive. To minimize risk you basically have to teach your team how to code and deploy securely, conduct security tests frequently, and frequently update your security infrastructure at a very fast cyclical pace. This can get expensive to do (time or ...


0

The SaaS offerors are not likely to agree to let you pen test their services. They might agree to independent testing but the testing frameworks are not likely to be comparable. So you will be hard-pressed to compare the findings by one to that of another. Unless you are soliciting $1B in business, perhaps FedRAMP certification is the best you can hope for. ...


3

In a SaaS model, you will likely not be able to perform code audits. This is because as stated, it is Software as a Service. Not software where you would be able to download the software itself, let alone the source code for the software. That task would be done at the discretion of the software vendor, and or provider. Please see "5 Problems with SaaS ...


1

I can think of following scenarios: Safety against SQL injection and login related attacks if your software has user accounts The accuracy and robustness of your access control if your software has users



Top 50 recent answers are included