Tag Info

Hot answers tagged

23

Some technical factors that may be relevant: Performance - across whatever matters for your application (if any): encryption/decryption/key generation/signing, symmetric, asymmetric, EC, ... Scale: Is there a limit to the number of keys it supports, and could that limit be a problem? How easy is it to add another HSM when your application becomes more ...


15

A HSM will not avoid complexity; rather, it will add quite a lot of complexity to the whole system. What HSM do best is key storage: the key is in the HSM and does not get out of it, never. However, you still have to worry about the key life cycle. With a "software" key, stored in a file or in the entrails of the operating system, backups are a ...


13

Here are the things on my list, that I use for my clients (including some of those that you've mentioned): Coverage (according to what the org requires today, and expects to use in the future) Language Architecture (e.g. some tools are great for web apps, but not so much for rich clients or even Windows Services / daemons) Framework (e.g. support for ...


10

My experience with Palo Alto is limited so please take what I say with a grain of salt (and I'm sure people here can correct me as necessary)... Palo Alto is a completely different firewall paradigm than Check Point, Juniper, or almost any other firewall. A traditional firewall defines traffic flow based on source IP, destination IP, and port (or IP ...


6

Here is the most important thing to know about how to evaluate a static analysis tool: Try it on your own code. I'll repeat that again. Try it on your own code. You need to run a trial, where you use it to analyze some representative code of yours, and then you analyze its output. The reason is that static analysis tools vary significantly in ...


5

I'd say that the PCI compliance aspect is going to complicate things more than a little bit and that you should really speak to your QSA about requirements. Whilst I'm not a QSA it would seem to me that if you backup card data then that backup service would effectively become part of your cardholder data environment. Apart from that one thing I always look ...


5

In no particular order and off the top of my head: Single vendor: easier and faster relationships (usually) better integration of different products, provided they're not rebranded kits simpler to "pass the buck" if products A and B don't see eye to eye - they're both the same vendor's responsibility. Multiple vendors: less risk of vendor lock-in more ...


3

I'd say that there is nothing per se which would always lead to outsourced software being less secure than an in-house development but there are some common factors which may in practice lead to this commonly being the case Cost concerns. If a key factor in winning the work is low cost, then the risk of insecure software is likely to increase. Whichever ...


3

Let me state up front, that I am a partner of Palo Alto Networks as well as Check Point and Juniper. Over the years we have had a lot of success with all three manufacturers. Palo Alto Networks has built a network security device that is technically different from everything else on the market. If you clear away the marketing BS, there is no denying it. My ...


3

If you want a secure account look at yourself not the bank. Banks rely on insurance to secure deposits, their security is there to keep the premiums low and the insurance will take care of anything that gets past. However if someone gets into your account via identity theft then the insurance will not cover the stolen funds. Therefore if you want a secure ...


3

Trying to cut the code review up into multiple pieces suffers from two problems. The first is the infamous and ever present problem of enumerating badness, and the second is the overhead of recruiting and managing the remote freelancers. Going for an open ended review will avoid the issues of splitting it up, but you will need to take care ensuring that ...


3

This may sound a bit of a cop-out, but at the end of the day it is down to what assurances you need from the provider so you should ask both of them the same questions - and these should be specifically on what you need to feel confidence that using the provider doesn't expose you to more risk than you can accept. Have a look at this question about EC2 ...


2

A long list of criteria is as likely to distract you as help you come up with a good solution. Take, for example, the issue of "false positives". It's an inherent problem with such tools. The long term solution is learning how to live with them. It means that your coders are going to have to learn to code around the static analysis tool, learn what causes ...


2

While I don't have any experience hiring someone from a freelance site to do code reviews, thinking about the question I believe that you are really looking for someone who can just be another eye to catch some omission. Sounds like a 'duh moment I know. But, if what you are asking if you can slap something together then just get a secure code editor to ...


2

One of the things I would look at is what the bank says about their security. That doesn't mean they are actually doing anything about it, but if they are talking about it at least they know it is important to their customers. I would research the security accreditations that the bank has, and the level of certification of its it staff if the information ...


2

Summary: Go with a big bank with a good password policy. MFA is a huge plus, but I wouldn't go to a small bank ever. Unfortunately if you are in the US, MFA is not very prevalent in the banking industry (at least for large banks). If you can find it, I would look there. And if you find that in a big bank (top 10), please let me know. =) Having ...


1

As a rule of thumb involving a third party complicates security. It does not mean the product (software or otherwise) cannot be secure, but it does add another factor into the equation. Things to consider: Quality of the staff Experience of the third party in creating software with a focus on security, i.e. the organization as a whole needs the right ...


1

I don't explicitly know the answer to your sourcing problem, but I do know a bit about the cards and their internals. That being said, I'm pretty sure GIS manufactures them. There are two classes of card internals: Discrete small pitch surface-mount components embedded inside the plastic. Custom chip-on-board encased in epoxy, again embedded in the ...


1

I've been a big fan of Gimpel's PC-Lint over the years for C++ code. The biggest two factors for me were language coverage (nobody else had it at the time, really), and "livability". Living with static analysis is kind of a subjective thing, as you know. Gimpel has a chapter in their manual called "Living with Lint" that does a good job talking through the ...


1

First if they claim to be PCI Compliant ask for the latest version of a filled out questionnaire and their current quarters scan results. Based on the depth of how they filled out the questionnaire you should have some understanding of how competant they are. Also press if they have external audits? Do they employ external companies to do manual pentests ...



Only top voted, non community-wiki answers of a minimum length are eligible