Skip to main content
116 votes
Accepted

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

Here's one data point from a software company that has an interest in security. I know this is common in similar organisations. There is a number of networks. They are physically separated and ...
Joe's user avatar
  • 1,294
71 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my experience, it is common for developers to have admin access on their own machines. It is also common for them not to have admin access on their own machines. However, in the latter situation ...
Joel Coehoorn's user avatar
52 votes

Comply with data protection requirements without giving away too much?

The request for this information may not only be for a security audit, but also a process audit, and it sounds like it might be well founded, since: If you wanted to break into their portion of ...
TTT's user avatar
  • 9,222
48 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

I work for a fairly large investment management firm (~6000 employees) and developers are one of the groups that we approve for local admin access. We tell them not to install any software, as that is ...
Justin's user avatar
  • 712
36 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my experience allowing and disallowing local admin access is common, just as common as dirty workarounds for the latter. - So you should ask yourself: Which threat to your network is made worse by ...
Falco's user avatar
  • 1,502
34 votes
Accepted

The non-compliance of the EU cookie law as a finding in a penetration test report?

I don't know of any technical security impact relating to not adhering to EU cookie laws. Ultimately I think this is mostly down to the discretion of the assessor and the context of the assessment. ...
Polynomial's user avatar
  • 135k
31 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my career, with rather small companies (less than 100 people), we always had local admin rights. We either have real desktop machines which are maintained by IT, but got the rights, or we were ...
Marcel's user avatar
  • 4,093
30 votes

Comply with data protection requirements without giving away too much?

You said "Very little of this stuff is actual legal requirement" but depending on which government this concerns, this may be a very strict legal requirement. If that government requires their ...
LeoB's user avatar
  • 438
29 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In a rather small department of a larger organization (~100 in department, ~3500 in full organization) we chose an in the middle solution: sysadmins had 2 accounts, one (non administrator even for ...
Serge Ballesta's user avatar
21 votes
Accepted

Does SOC-2 compliance require password rotation

SOC 2 Type 2 does not have specific technical requirements. What you have to do is to satisfy your assessor. And if your company cannot satisfy your assessor, then there is a mechanism called "...
schroeder's user avatar
  • 131k
18 votes

Can a large corporation make a believable promise

However, if the third party makes a secret copy, then they can covertly sell it for large amounts of money. The thing about this is when it comes to a pivotal and highly-valued asset such as said key,...
mallocation's user avatar
  • 1,676
17 votes

Comply with data protection requirements without giving away too much?

Not to pile on too much, but your question exposes a serious flaw in the system, which is you. You are a single point of failure, and that's pretty far from best-practices. Depending on the ...
HopelessN00b's user avatar
  • 3,417
16 votes
Accepted

Can a large corporation make a believable promise

Companies make promises they can't renege on all the time - that's what a contract is. After all, insurance wouldn't exist if an insurer could wriggle out of paying claims through things like secret ...
mjt's user avatar
  • 415
14 votes

The non-compliance of the EU cookie law as a finding in a penetration test report?

A vulnerability is something that leaves you open to the possibility of being harmed. Being prosecuted or sued for violating the law is a form of harm. Therefore, not complying with the law is a ...
David Schwartz's user avatar
13 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my experience working for larger organizations, it is absolutely not common for developers to have full rights to anything other than development specific resources. It seems like your organization ...
John-M's user avatar
  • 251
13 votes
Accepted

InfoSec certifications for global startup

That's not how this works. You don't collect certificates. being certified does not mean that you are secure customers only care about the certificates they care about The "best" certification is ...
schroeder's user avatar
  • 131k
11 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

First of all you need to learn that it does not matter what "is common" or "typical" because: typically such situations are handled horribly. You are making the best case for this statement. If ...
Tom K.'s user avatar
  • 7,966
9 votes
Accepted

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

"FIPS compliance" is about more than the algorithm. It is about implementations. Being awarded the "compliant" badge is a long, complex and very expensive process; its conceptual meaning is that there ...
Tom Leek's user avatar
  • 173k
9 votes
Accepted

If I'm PCI-DSS compliant, do I need to worry about GDPR?

Assuming GDPR apply to your organization, yes you should worry about GDPR. PCI-DSS compliance doesn't imply GDPR compliance. There are many concept present in GDPR and not in PCI-DSS or not with the ...
Whysmerhill's user avatar
9 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

This fundamentally depends on context, and in particular on your threat model. In some organisations, it's common to give developers complete control over their development workstation, to the point ...
James_pic's user avatar
  • 2,580
9 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

The problem you actually have is competent IT are attempting to enforce a boneheaded rule. You really only have one choice, give developers effective admin access. I keep seeing the same advice being ...
Joshua's user avatar
  • 1,146
9 votes
Accepted

Which self assessment questionairre should I use for PCI DSS compliance

Unfortunately for you, because the raw card data transits your servers in cleartext, you have to use SAQ D, and because you aren't the merchant yourself, it would be SAQ D for Service Providers. ...
Bobson's user avatar
  • 1,465
9 votes

Can a large corporation make a believable promise

How could the company show that it instructed the employees to destroy the key? Easy. When an employee was instructed, he/she signs a document that he/she was instructed and understood fully the ...
mentallurg's user avatar
  • 12.4k
8 votes

Steps to become SOC 2 compliant?

I am an IT security professional, currently working as an IT Auditor and am very familiar with the SOC 2 attestations.To answer your question, it helps to first give a little of background into the ...
Anthony's user avatar
  • 1,756
8 votes

The non-compliance of the EU cookie law as a finding in a penetration test report?

This is a security issue for the users. Non-compliance of cookie-related laws includes that cookie data is being built about you while on the site, after you have clicked 'opt-out'. If the site does ...
New Alexandria's user avatar
8 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

I've seen two approaches that work. Give developers admin access to their machines. This is the easiest and most common approach. It is usually the best choice Create a team in the organisation whose ...
UEFI's user avatar
  • 222
8 votes

Can a large corporation make a believable promise

I am not sure I completely understood your question, but technically speaking you may want to use an encryption method which distributes the key to several parties, and all must be present in order to ...
WoJ's user avatar
  • 9,048
7 votes

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

There are two different notions of compliance here: Using a compliant algorithm — the official term is “Approved”. Hash algorithms for HMAC are Approved if they are listed in FIPS 180-4 (or earlier ...
Gilles 'SO- stop being evil''s user avatar
7 votes

Is Segregation of Duties a Requirement?

As the O'Reilly book, DevOpsSec details in chapter 2, Separation of Duties (SoD) is a major component of the information-security standards: ISO 27001, NIST SP 800-53, COBIT, ITIL, etc -- and part of ...
atdre's user avatar
  • 19.1k
7 votes

I need assistance in properly understanding the IA-7 control in NIST SP 800-53

Waking the zombie at my own peril and for the benefit of people looking to understand this control. I did a fair amount of research on the subject and was able to find a pretty definitive answer. ...
Adam's user avatar
  • 71

Only top scored, non community-wiki answers of a minimum length are eligible