438
votes
Accepted
Is it normal for auditors to require all company passwords?
Is this normal for a pentest?
Absolutely not. Best case scenario: they are performing "social engineering" penetration testing and want to see if you can be pressured into fulfilling a very ...
- 30.8k
140
votes
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me?
You can't vet individual lines of code. You'll just die trying to do that.
At some point, you have to trust someone else. In 1984, Ken Thompson, one of the co-inventors of much of Unix, wrote a short ...
- 31.3k
116
votes
Accepted
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
Here's one data point from a software company that has an interest in security. I know this is common in similar organisations.
There is a number of networks. They are physically separated and ...
- 1,284
113
votes
Is it normal for auditors to require all company passwords?
How should I proceed?
Don't proceed with them. The way they act is unprofessional. Pentests carry risks for both parties, and it doesn't seem they did anything to address them.
First, you should ...
- 44.5k
71
votes
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
In my experience, it is common for developers to have admin access on their own machines. It is also common for them not to have admin access on their own machines. However, in the latter situation ...
- 2,206
53
votes
Comply with data protection requirements without giving away too much?
The request for this information may not only be for a security audit, but also a process audit, and it sounds like it might be well founded, since:
If you wanted to break into their portion of ...
- 9,182
49
votes
Is C a good choice for security-related software any longer?
The main and almost unique reason why most software in the Linux ecosystem is written in C is Tradition. Developers see software written in C, libraries with a C-based API, and thus they use C, ...
- 172k
49
votes
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
I work for a fairly large investment management firm (~6000 employees) and developers are one of the groups that we approve for local admin access. We tell them not to install any software, as that is ...
- 722
48
votes
Accepted
Is the unauthorized deletion of data considered a breach of integrity or availability?
However, one of my colleagues disagrees and considers such to be an attack on the Integrity principle, because data was modified by being destroyed without authorization.
Your colleague has a point. ...
- 44.5k
47
votes
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me?
My "Composer" directory tree currently is at over 120,000 lines of code. And that's for the minimal number of crucial PHP libraries that I need.
Your mistake is in trying to vet third-party code as ...
- 541
40
votes
Why is privacy not one of the pillars of information security?
Confidentiality is generally a privacy concern. It's just a more general term.
It's like saying animal instead of dog.
In addition to the definitions, you can confirm that by searching for synonyms ...
- 541
38
votes
Is it normal for auditors to require all company passwords?
Prior to any penetration test there should be a Scoping and Rules of Engagement document(s) that is signed by both parties. These documents should describe in detail what will be tested and what ...
- 466
36
votes
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
In my experience allowing and disallowing local admin access is common, just as common as dirty workarounds for the latter. - So you should ask yourself:
Which threat to your network is made worse by ...
- 1,502
31
votes
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
In my career, with rather small companies (less than 100 people), we always had local admin rights. We either have real desktop machines which are maintained by IT, but got the rights, or we were ...
- 4,066
30
votes
Comply with data protection requirements without giving away too much?
You said "Very little of this stuff is actual legal requirement" but depending on which government this concerns, this may be a very strict legal requirement. If that government requires their ...
- 438
29
votes
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
In a rather small department of a larger organization (~100 in department, ~3500 in full organization) we chose an in the middle solution:
sysadmins had 2 accounts, one (non administrator even for ...
- 26.1k
27
votes
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me?
Welcome to the new paradigm of coding: you're using libraries on top of libraries. You're hardly alone, but you also need to understand that anytime you bring in code you didn't write, you bring in ...
- 3,798
25
votes
Is C a good choice for security-related software any longer?
You can write secure code in C. Its just that the language is unsafe by default. The safety has to be tacked on manually with extra code (which of course can itself contain bugs).
For that reason, C ...
- 351
25
votes
Is it normal for auditors to require all company passwords?
NEVER EVER!!
We are doing a full pentest at my work. It was explicitly stated by the pentesters that they don't even need the login/password for anything. We stated that it was great since we'd ...
- 391
20
votes
Is it normal for auditors to require all company passwords?
My company is currently engaged in a security audit framed as a pentest.
and
Note, we've never signed a single NDA or other contract with them yet, and I'm very reluctant to provide this info to ...
- 3,977
19
votes
Accepted
Is it safe to store SSN's in Azure Cloud?
Given the current state of public cloud, I would argue that in many cases it is in fact more secure than on-premise storage. Granted I work for Microsoft, but my opinion both pre-dates my employment, ...
- 35.7k
19
votes
Accepted
Has malware ever been found in a package from a large Linux distribution and what is done to prevent this from occurring?
Linux Mint was compromised and a backdoored ISO was deployed, Ubuntu was compromised, the entire Linux Kernel was compromised before, as were others (Debian, FreeBSD, etc). Developers protect code ...
- 8,682
19
votes
Accepted
Why is privacy not one of the pillars of information security?
Firstly, CIA (confidentiality, integrity, and availability) are not comprehensive goals for information security. Other principles like privacy and non-repudiation don't fit cleanly into this famous ...
- 1,148
17
votes
Comply with data protection requirements without giving away too much?
Not to pile on too much, but your question exposes a serious flaw in the system, which is you.
You are a single point of failure, and that's pretty far from best-practices.
Depending on the ...
- 3,397
15
votes
is my scheme is less secure than the 99% of websites exposed to theses attacks?
No, this is a steaming mess. In fact it would be a misnomer to even call this 2FA. Really what you've done is eliminate one of the factors and this is closer to side channel authentication than two ...
- 1,324
13
votes
Is the unauthorized deletion of data considered a breach of integrity or availability?
In my opinion you shouldn't put a vulnerability into the CIA triad. Because if you do then you have to put it in all of these three criteria. For example:
Confidentiality: When there is a ...
- 1,126
13
votes
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
In my experience working for larger organizations, it is absolutely not common for developers to have full rights to anything other than development specific resources.
It seems like your organization ...
- 251
12
votes
Accepted
Why do several bug bounties ignore user enumeration?
Because they are already aware of the issue. This is evident of them making a mention on the exclusion list. Not mentioning it would likely lead to a lot of users pointing it out.
And since they are ...
- 3,352
11
votes
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
First of all you need to learn that it does not matter what "is common" or "typical" because:
typically such situations are handled horribly. You are making the best case for this statement.
If ...
- 7,945
9
votes
Accepted
Does git commit hash prove the history until that point?
Not against sophisticated agents with lots of resources. SHA-1 (the hash used in git) is not considered cryptographically secure these days against collision attacks. With published methods for a ...
- 39.2k
Only top scored, non community-wiki answers of a minimum length are eligible