Tag Info

New answers tagged

2

Mobile Device Management (MDM) Software is enterprise software that covers the management of applications and device security. MDM software varies in capabilities depending on the operating system (Android, iOS, Windows) you are supporting. Some commercial MDM solutions will include the ability to manage multiple operating systems while others are tailored ...


0

In addition to Polynomial's excellent answer, I've been seeking "pre-packaged in one complete document or template" solutions for more-general policies/coverage and have thus far found: https://www.instantsecuritypolicy.com/products.html http://www.information-security-policies.com/ http://www.myinformationsecuritypolicy.com/collections/all ...


7

While cleartext storage of passwords is a bad thing, some kinds of "reversible obfuscation" (e.g. Base64 encoding, or ROT13 "encryption") are not much better, and should be detected as well. The right way to audit the password storage and verification method is to look at the specification, i.e. the document that states what algorithm is used, and with what ...


2

The best way to check this is source code review. You should check that the application uses strong hashing, how it uses salt, and doesn't log sensitive data. Also, if the password database supports hash upgrade, then make sure that you take note of the weakest hashing scheme that's still accepted and how many users are still on older/weaker hash. The ...


2

I would inspect the password storage to see if there are noticeable patterns (e.g. "password1234"), or create a 'test user' with a known password and see if that password is in cleartext in the password stores. The latter option allows for the possibility of automated tests. Mostly though, this type of audit only needs to be performed once and upon changes ...



Top 50 recent answers are included