New answers tagged

0

Ever heard of RSA? Much more safe and much more simple. Every client generates an private key and sends its public key to the server. The client that starts a group generates an AES key for encrypting group files and decrypts the key with each public key of the other members. Than it sends the encrypted keys to the other members. They use their private key ...


3

I recommend OSSEC, and or (mentioned by Schroeder) Tripwire. However, I also recommend principle of least privileges. If you have your developers all using escalated privileges to do their work, I emphasize placing them in groups, and using sudo. For added measures, I'd add timestamps to bash history files where applicable. This will enable you to track what ...


0

Payment processing software involving cards (debit, credit, etc.) falls under the purview of the Payment Card Industry Data Security Standards (PCI DSS) and more specifically the Payment Application Data Security Standards (PA-DSS) published by the PCI Security Standards Council. As such, there is a wealth of information on this site under the tag pci-dss. ...


2

Certification depends on the nature of the software, how it will be used and where it will be used (country, industry, etc...). Without that specific information we can't help you. Third party reporting can be done by several institutions and companies. ISO27001 is an information security management system, CIS is a company providing services and creating ...


0

I am an IT auditor myself. My answer comes from experience. Am I wrong to feel it is unreasonable and unproductive to be examining these logs? Yes, your belief is wrong and unreasonable. Audit logs, if designed correctly to capture the most relevant information, are an invaluable tool to assist detection of fraud / data breach / employee non-...


1

Whenever we submit an offer for a penetration test we are facing the same question: How complex is the application? Complexity leads to additional attack surface, which leads to a lot of tests, which might lead to a lot of findings which require a lot of documentation. This effort has to be reflected within the offering. To determine the possible complexity ...


0

As an a practicing IT Auditor, let me provide you an answer from experience. Before I explain, I want to say that Your approach is fundamentally flawed from the question you asked in the question body. What software tools are required This form of thinking is misguided. The first step in performing a professional audit is planning and gathering ...


4

Because they are already aware of the issue. This is evident of them making a mention on the exclusion list. Not mentioning it would likely lead to a lot of users pointing it out. And since they are aware you might be wondering why they won't fix it. There really isn't a way to prevent it. If they restrict an email to one sign up they will have to inform ...



Top 50 recent answers are included