Hot answers tagged

67

TLDR: There are several categories of security you must consider when looking for a phone. The main advice, though, is to get a newer phone with the latest security features, and from a manufacturer that has a good reputation of providing updates. Security against other people (peers, police/government) Summary: Look for newer devices with full disk ...


59

One of the key aspects to consider for this is the support/patching policy of your mobile device vendor. If you're planning to keep the phone for say 2-3 years you don't want it to go out of support after 18 months. Unfortunately this can be quite tricky information to come across with many vendors not providing published support lifecycles. Also ...


36

The other answers regarding encryption are great. I'm going to approach this question from the tinfoil / dissident angle, as I believe it's valid for nearly every scenario... but I still want to explain my reasoning, and how I came to these conclusions. All of the problems I'll discuss are routinely exploited by criminals, and repressive governments. In ...


27

Some technical factors that may be relevant: Performance - across whatever matters for your application (if any): encryption/decryption/key generation/signing, symmetric, asymmetric, EC, ... Scale: Is there a limit to the number of keys it supports, and could that limit be a problem? How easy is it to add another HSM when your application becomes more ...


18

A HSM will not avoid complexity; rather, it will add quite a lot of complexity to the whole system. What HSM do best is key storage: the key is in the HSM and does not get out of it, never. However, you still have to worry about the key life cycle. With a "software" key, stored in a file or in the entrails of the operating system, backups are a ...


17

Trying to avoid recommendations, to keep your phone safe an secure I will break it down into 3 levels: Applications When looking for applications to place on your phone you need to look at the permissions they ask for and ask yourself, Does this chess game really need access to my contacts, bluetooth and internet? NO it does not, an app to me is suspicious ...


14

Here are the things on my list, that I use for my clients (including some of those that you've mentioned): Coverage (according to what the org requires today, and expects to use in the future) Language Architecture (e.g. some tools are great for web apps, but not so much for rich clients or even Windows Services / daemons) Framework (e.g. support for ...


11

My experience with Palo Alto is limited so please take what I say with a grain of salt (and I'm sure people here can correct me as necessary)... Palo Alto is a completely different firewall paradigm than Check Point, Juniper, or almost any other firewall. A traditional firewall defines traffic flow based on source IP, destination IP, and port (or IP ...


6

First of all: There's a good guide from the TOR project about hardening Android. You can deduce all criteria you have to look for from it. Second: I can't believe that nobody here even mentions the biggest backdoor which circumvents most security measures as long the telephone is turned on: the baseband processor. There were already some vulnerabilities ...


6

I'd say that the PCI compliance aspect is going to complicate things more than a little bit and that you should really speak to your QSA about requirements. Whilst I'm not a QSA it would seem to me that if you backup card data then that backup service would effectively become part of your cardholder data environment. Apart from that one thing I always look ...


6

Here is the most important thing to know about how to evaluate a static analysis tool: Try it on your own code. I'll repeat that again. Try it on your own code. You need to run a trial, where you use it to analyze some representative code of yours, and then you analyze its output. The reason is that static analysis tools vary significantly in ...


5

In no particular order and off the top of my head: Single vendor: easier and faster relationships (usually) better integration of different products, provided they're not rebranded kits simpler to "pass the buck" if products A and B don't see eye to eye - they're both the same vendor's responsibility. Multiple vendors: less risk of vendor lock-in more ...


4

I'd say that there is nothing per se which would always lead to outsourced software being less secure than an in-house development but there are some common factors which may in practice lead to this commonly being the case Cost concerns. If a key factor in winning the work is low cost, then the risk of insecure software is likely to increase. Whichever ...


3

This may sound a bit of a cop-out, but at the end of the day it is down to what assurances you need from the provider so you should ask both of them the same questions - and these should be specifically on what you need to feel confidence that using the provider doesn't expose you to more risk than you can accept. Have a look at this question about EC2 ...


3

If you want a secure account look at yourself not the bank. Banks rely on insurance to secure deposits, their security is there to keep the premiums low and the insurance will take care of anything that gets past. However if someone gets into your account via identity theft then the insurance will not cover the stolen funds. Therefore if you want a secure ...


3

Let me state up front, that I am a partner of Palo Alto Networks as well as Check Point and Juniper. Over the years we have had a lot of success with all three manufacturers. Palo Alto Networks has built a network security device that is technically different from everything else on the market. If you clear away the marketing BS, there is no denying it. My ...


3

Trying to cut the code review up into multiple pieces suffers from two problems. The first is the infamous and ever present problem of enumerating badness, and the second is the overhead of recruiting and managing the remote freelancers. Going for an open ended review will avoid the issues of splitting it up, but you will need to take care ensuring that ...


2

While I don't have any experience hiring someone from a freelance site to do code reviews, thinking about the question I believe that you are really looking for someone who can just be another eye to catch some omission. Sounds like a 'duh moment I know. But, if what you are asking if you can slap something together then just get a secure code editor to ...


2

A long list of criteria is as likely to distract you as help you come up with a good solution. Take, for example, the issue of "false positives". It's an inherent problem with such tools. The long term solution is learning how to live with them. It means that your coders are going to have to learn to code around the static analysis tool, learn what causes ...


2

Summary: Go with a big bank with a good password policy. MFA is a huge plus, but I wouldn't go to a small bank ever. Unfortunately if you are in the US, MFA is not very prevalent in the banking industry (at least for large banks). If you can find it, I would look there. And if you find that in a big bank (top 10), please let me know. =) Having ...


2

One of the things I would look at is what the bank says about their security. That doesn't mean they are actually doing anything about it, but if they are talking about it at least they know it is important to their customers. I would research the security accreditations that the bank has, and the level of certification of its it staff if the information ...


1

The level of security you receive from software is almost entirely determined by the talent and experience of the software developers, rather than the relationship you have with them. Consider two developers, let's call them A and B. A knows how to write the software very securely, and B does not. Both A and B may be hired as employees or as contractors, and ...


1

As a rule of thumb involving a third party complicates security. It does not mean the product (software or otherwise) cannot be secure, but it does add another factor into the equation. Things to consider: Quality of the staff Experience of the third party in creating software with a focus on security, i.e. the organization as a whole needs the right focus,...


1

I don't explicitly know the answer to your sourcing problem, but I do know a bit about the cards and their internals. That being said, I'm pretty sure GIS manufactures them. There are two classes of card internals: Discrete small pitch surface-mount components embedded inside the plastic. Custom chip-on-board encased in epoxy, again embedded in the ...


1

First if they claim to be PCI Compliant ask for the latest version of a filled out questionnaire and their current quarters scan results. Based on the depth of how they filled out the questionnaire you should have some understanding of how competant they are. Also press if they have external audits? Do they employ external companies to do manual pentests ...


1

I've been a big fan of Gimpel's PC-Lint over the years for C++ code. The biggest two factors for me were language coverage (nobody else had it at the time, really), and "livability". Living with static analysis is kind of a subjective thing, as you know. Gimpel has a chapter in their manual called "Living with Lint" that does a good job talking through the ...



Only top voted, non community-wiki answers of a minimum length are eligible