Tag Info

New answers tagged

0

The biggest thing you want to do is to understand and then communicate what your expectations are. If your security model forbids opening a firewall port, is that documented? (As an aside, if you expect that you're safe because you're behind a firewall, I suggest rethinking, but I think you're using that as an example.) You can either document in a ...


1

Typically, your code would be tested & remediated against vulnerabilities in pre-prod/staging environments before going in to production. Yes, not all environments are same so some measures I've taken are using Splunk (aka log correlation tools) to monitor deployments and correlating it with web activities for {x} hours after the deployment. This ...


2

Typically what you would do here is integrate some form of testing procedure into your deployment or post-deployment process. This could be as lightweight as a simple port scan, which could identify ports left open inadvertently, or as large as a full 3rd party security assessment (aka penetration test) where you contract a 3rd party to review the security ...



Top 50 recent answers are included