Skip to main content
Share Your Experience: Take the 2024 Developer Survey
437 votes
Accepted

Is it normal for auditors to require all company passwords?

Is this normal for a pentest? Absolutely not. Best case scenario: they are performing "social engineering" penetration testing and want to see if you can be pressured into fulfilling a very ...
Conor Mancone's user avatar
140 votes

How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me?

You can't vet individual lines of code. You'll just die trying to do that. At some point, you have to trust someone else. In 1984, Ken Thompson, one of the co-inventors of much of Unix, wrote a short ...
Lie Ryan's user avatar
  • 31.4k
115 votes
Accepted

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

Here's one data point from a software company that has an interest in security. I know this is common in similar organisations. There is a number of networks. They are physically separated and ...
Joe's user avatar
  • 1,284
112 votes

Is it normal for auditors to require all company passwords?

How should I proceed? Don't proceed with them. The way they act is unprofessional. Pentests carry risks for both parties, and it doesn't seem they did anything to address them. First, you should ...
Arminius's user avatar
  • 44.8k
71 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my experience, it is common for developers to have admin access on their own machines. It is also common for them not to have admin access on their own machines. However, in the latter situation ...
Joel Coehoorn's user avatar
52 votes

Comply with data protection requirements without giving away too much?

The request for this information may not only be for a security audit, but also a process audit, and it sounds like it might be well founded, since: If you wanted to break into their portion of ...
TTT's user avatar
  • 9,222
49 votes

Is C a good choice for security-related software any longer?

The main and almost unique reason why most software in the Linux ecosystem is written in C is Tradition. Developers see software written in C, libraries with a C-based API, and thus they use C, ...
Tom Leek's user avatar
  • 173k
48 votes
Accepted

Is the unauthorized deletion of data considered a breach of integrity or availability?

However, one of my colleagues disagrees and considers such to be an attack on the Integrity principle, because data was modified by being destroyed without authorization. Your colleague has a point. ...
Arminius's user avatar
  • 44.8k
48 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

I work for a fairly large investment management firm (~6000 employees) and developers are one of the groups that we approve for local admin access. We tell them not to install any software, as that is ...
Justin's user avatar
  • 712
46 votes

How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me?

My "Composer" directory tree currently is at over 120,000 lines of code. And that's for the minimal number of crucial PHP libraries that I need. Your mistake is in trying to vet third-party code as ...
Spudley's user avatar
  • 541
40 votes

Why is privacy not one of the pillars of information security?

Confidentiality is generally a privacy concern. It's just a more general term. It's like saying animal instead of dog. In addition to the definitions, you can confirm that by searching for synonyms ...
Simon's user avatar
  • 541
38 votes

Is it normal for auditors to require all company passwords?

Prior to any penetration test there should be a Scoping and Rules of Engagement document(s) that is signed by both parties. These documents should describe in detail what will be tested and what ...
countrhack's user avatar
36 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my experience allowing and disallowing local admin access is common, just as common as dirty workarounds for the latter. - So you should ask yourself: Which threat to your network is made worse by ...
Falco's user avatar
  • 1,502
31 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my career, with rather small companies (less than 100 people), we always had local admin rights. We either have real desktop machines which are maintained by IT, but got the rights, or we were ...
Marcel's user avatar
  • 4,084
30 votes

Comply with data protection requirements without giving away too much?

You said "Very little of this stuff is actual legal requirement" but depending on which government this concerns, this may be a very strict legal requirement. If that government requires their ...
LeoB's user avatar
  • 438
29 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In a rather small department of a larger organization (~100 in department, ~3500 in full organization) we chose an in the middle solution: sysadmins had 2 accounts, one (non administrator even for ...
Serge Ballesta's user avatar
26 votes

How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me?

Welcome to the new paradigm of coding: you're using libraries on top of libraries. You're hardly alone, but you also need to understand that anytime you bring in code you didn't write, you bring in ...
Machavity's user avatar
  • 3,798
25 votes

Is C a good choice for security-related software any longer?

You can write secure code in C. Its just that the language is unsafe by default. The safety has to be tacked on manually with extra code (which of course can itself contain bugs). For that reason, C ...
T.E.D.'s user avatar
  • 351
25 votes

Is it normal for auditors to require all company passwords?

NEVER EVER!! We are doing a full pentest at my work. It was explicitly stated by the pentesters that they don't even need the login/password for anything. We stated that it was great since we'd ...
rockower's user avatar
  • 391
20 votes

Is it normal for auditors to require all company passwords?

My company is currently engaged in a security audit framed as a pentest. and Note, we've never signed a single NDA or other contract with them yet, and I'm very reluctant to provide this info to ...
YLearn's user avatar
  • 4,017
19 votes
Accepted

Is it safe to store SSN's in Azure Cloud?

Given the current state of public cloud, I would argue that in many cases it is in fact more secure than on-premise storage. Granted I work for Microsoft, but my opinion both pre-dates my employment, ...
Xander's user avatar
  • 35.8k
19 votes
Accepted

Has malware ever been found in a package from a large Linux distribution and what is done to prevent this from occurring?

Linux Mint was compromised and a backdoored ISO was deployed, Ubuntu was compromised, the entire Linux Kernel was compromised before, as were others (Debian, FreeBSD, etc). Developers protect code ...
munkeyoto's user avatar
  • 8,692
19 votes
Accepted

Why is privacy not one of the pillars of information security?

Firstly, CIA (confidentiality, integrity, and availability) are not comprehensive goals for information security. Other principles like privacy and non-repudiation don't fit cleanly into this famous ...
RealAnswersNotAI's user avatar
17 votes

Comply with data protection requirements without giving away too much?

Not to pile on too much, but your question exposes a serious flaw in the system, which is you. You are a single point of failure, and that's pretty far from best-practices. Depending on the ...
HopelessN00b's user avatar
  • 3,407
15 votes

is my scheme is less secure than the 99% of websites exposed to theses attacks?

No, this is a steaming mess. In fact it would be a misnomer to even call this 2FA. Really what you've done is eliminate one of the factors and this is closer to side channel authentication than two ...
Caleb's user avatar
  • 1,324
13 votes
Accepted

Why do several bug bounties ignore user enumeration?

Because they are already aware of the issue. This is evident of them making a mention on the exclusion list. Not mentioning it would likely lead to a lot of users pointing it out. And since they are ...
Bacon Brad's user avatar
  • 3,392
13 votes

Is the unauthorized deletion of data considered a breach of integrity or availability?

In my opinion you shouldn't put a vulnerability into the CIA triad. Because if you do then you have to put it in all of these three criteria. For example: Confidentiality: When there is a ...
arif's user avatar
  • 1,156
13 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my experience working for larger organizations, it is absolutely not common for developers to have full rights to anything other than development specific resources. It seems like your organization ...
John-M's user avatar
  • 251
11 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

First of all you need to learn that it does not matter what "is common" or "typical" because: typically such situations are handled horribly. You are making the best case for this statement. If ...
Tom K.'s user avatar
  • 7,966
10 votes
Accepted

Does git commit hash prove the history until that point?

Not against sophisticated agents with lots of resources. SHA-1 (the hash used in git) is not considered cryptographically secure these days against collision attacks. With published methods for a ...
dr jimbob's user avatar
  • 39.4k

Only top scored, non community-wiki answers of a minimum length are eligible