0

I am a app developer and working with another software group at my MEGACOMPANY. Said group wants to put confidential information on the internet and they are very happy with their authentication system which just blocks that content from our normal customers based on IP address.

I have already cracked their system yet the bosses at MEGACOMPANY tell me that I can crack any system so me getting into the content doesn't equate to a security issue (please giggle a little).

I am asking for SSO authentication as we have on 99% of our sites. They want to keep current system for a variety of reasons. How secure do you believe this site to be? Also are there methods that robots or joe-average-instigator would use to gain access to the information?

  • "I have already cracked their system yet the bosses at MEGACOMPANY tell me that I can crack any system so me getting into the content doesn't equate to a security issue (please giggle a little)." Uhhhhh... if you can do it so can many many other people (not intending to put your skills down!) – AlexH Feb 3 '15 at 16:35
  • 1
    @darkf - Exactly! – blankip Feb 3 '15 at 16:38
1

If you have shown the stakeholders the risk and they have decided to accept the risk as "not likely", then the decision is out of your hands. You need to continue to educate, educate, educate, but you need to understand that it is management's job to manage the costs and risks to the company. InfoSec's job is to serve the company, even if the decisions the company makes is not "best practice".

Your job now, because you understand the threat, is to come up with ways to mitigate the risk that you identified and present that plan to the stakeholders. "If someone like me were to want to get the data, they would to X, and this is how we can mitigate that breach."

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.