Tag Info

Hot answers tagged

19

I haven't personally had to make this decision, though I do work in an environment where such separation of duties is implemented. Are you the owner of this business or are you working for someone else? Reason I ask is because realistically this comes down to a business decision. (barring the obvious infosec perspective of - "SEPARATE ALL THE THINGS!") ...


14

Welcome to the world of enterprise IT security. As you've found out, it's easy for security departments to make recommendations waving vaguely at "best practice". It's much harder to implement this on the ground. But you can address this, and you will get some benefits. One-click deployments - new releases should be packaged so they can be installed easily. ...


7

I generally dislike security questions in general; they usually ask for information that is more or less public. Mother's maiden name? Ancestry.com will tell you that. Your high school? Facebook, LinkedIn, any of a number of social media sites that use the info to suggest potential friends will not only have it, they'll advertise it if you aren't careful ...


4

I agree with the other answers that the "security questions" really don't do much good. The theory behind them is that only you will know the answers to those questions, and they will be used to let you back in to your account should you have forgotten your password. Unfortunately, the answers to most security questions can be found online if the attacker ...


2

Security question is actually a misnomer as it doesn't really improve security of an account but is more like having a back door to the house. You don't have a key (password) to the front door, no problem, enter from the back if you know the number to open the combination lock. That said, the method you proposed is akin to requiring the same key for the ...


2

An implementation of what you suggest has been a round for a while: it's called SecurID The clocks are synced and the token ID and clock are used to create a time-limited password unique to the token. In essence, an ever-changing password.


1

Okay, so you are trying to protect against an attacker who HAS access to your database from benefiting from it. If I was said attacker I would cycle through your user table and create new hashes for a standard password for all of the users. As you are using a salt that will mean that the hash table grows by the number of users, but since you have such a ...


1

TL;TR It really depends on the organization. Things to consider: How seriously do they take security? Is there a lot of travel that would lead to an increased risk of compromise? Is a stolen computer or physical removal of a drive a risk? The overhead for putting this into place is low. For a large company with lot of company travel it's worth it to ...



Only top voted, non community-wiki answers of a minimum length are eligible