Tag Info

New answers tagged

0

There are plenty of risk assessment methodologies. You first question should be "why building yet another one"? The ones which exist are either generic (COBIT-based, NIST SP 800-30, Mehari, ...) or specific to an area (the EU Critical Infrastructure Protection for instance). By using an established methodology you build credit in what you will deliver.


1

If desktop computers are within scope of your PCI boundary then they will have to be subject to the same controls as any other device in scope. This means a number of controls on the configuration, AV and malware protection, security policy (password management controls), etc. as well as processes around usage need to be considered. There is nothing specific ...


0

For the main part, configuration assessments of windows tablets are exactly the same as for standard windows builds and the approaches and resources would be the same (e.g. CIS security benchmarks). The only likely unique point for a tablet review would be the presence/absence of hardware features like TPM chips which can support full disk encryption. ...


4

What is an ITGC Audit? ITGC stands for Information Technology General Controls. While it sounds general, there's a backing standard and set of documentation that auditors use to maintain some consistency from the IIA (Institute of Internal Auditors). Non-members of IIA can buy copies. Some important points - It's a standard, not just a willy-nilly ...


7

While cleartext storage of passwords is a bad thing, some kinds of "reversible obfuscation" (e.g. Base64 encoding, or ROT13 "encryption") are not much better, and should be detected as well. The right way to audit the password storage and verification method is to look at the specification, i.e. the document that states what algorithm is used, and with what ...


2

The best way to check this is source code review. You should check that the application uses strong hashing, how it uses salt, and doesn't log sensitive data. Also, if the password database supports hash upgrade, then make sure that you take note of the weakest hashing scheme that's still accepted and how many users are still on older/weaker hash. The ...


2

I would inspect the password storage to see if there are noticeable patterns (e.g. "password1234"), or create a 'test user' with a known password and see if that password is in cleartext in the password stores. The latter option allows for the possibility of automated tests. Mostly though, this type of audit only needs to be performed once and upon changes ...


0

If you're worried about giving your source code to a third party, then don't. Bring the third party on-site to perform the code review and don't permit them to take the source code away with them. This also means they can sit with a developer and have responses to any questions they have quite quickly. The developer will also have the opportunity to learn ...


2

If you're contracting with a company to pen test and audit your app, you will be wise to scope out exactly what is in the limits of said test, what will be tested and how (it appears you are giving them source to be able to white-box test as well). They will likely work with you to establish the legal agreements that indemnifies them. It should also spell ...



Top 50 recent answers are included