114

Here's one data point from a software company that has an interest in security. I know this is common in similar organisations. There is a number of networks. They are physically separated and airgapped, run different colour-coded network cables. Each employee has an 'administration' machine, which can connect to the Internet (via a proxy) for doing email ...


70

In my experience, it is common for developers to have admin access on their own machines. It is also common for them not to have admin access on their own machines. However, in the latter situation some accommodation is generally made so they can get their jobs done without too much friction. One very common accommodation is access to a Hypervisor on the ...


63

Cardholder name, 4 last digits of CC number and its expiration date are all NOT sensitive data. The cardholder name and expiration date only require protection if you are storing them with the full primary account number, not the truncated 4 digit number. If you are storing, processing, or transmitting cardholder data then you must meet all of the other PCI ...


53

The request for this information may not only be for a security audit, but also a process audit, and it sounds like it might be well founded, since: If you wanted to break into their portion of this system, you come after me. What would happen if you were "hit by a truck" tomorrow? If you are the only one that knows the systems, your clients and theirs ...


47

I work for a fairly large investment management firm (~6000 employees) and developers are one of the groups that we approve for local admin access. We tell them not to install any software, as that is handled by local desktop/software compliance. We also have a Developers AD Group that allows members to change the execution policy on their machines without ...


35

I don't know of any technical security impact relating to not adhering to EU cookie laws. Ultimately I think this is mostly down to the discretion of the assessor and the context of the assessment. Privacy issues are security-adjacent and come with similar PR impacts, and may even be judged to infringe upon the rights of the individual, so I think in some ...


32

In my experience allowing and disallowing local admin access is common, just as common as dirty workarounds for the latter. - So you should ask yourself: Which threat to your network is made worse by local admin rights? To which the answer shoud be: NONE - The access to resources in your network should be restricted on a per user basis, completely ...


30

You said "Very little of this stuff is actual legal requirement" but depending on which government this concerns, this may be a very strict legal requirement. If that government requires their departments/agencies to follow NIST SP800-53 then they can't just answer "we have a guy." The answers to these security controls require detailed information giving ...


30

In my career, with rather small companies (less than 100 people), we always had local admin rights. We either have real desktop machines which are maintained by IT, but got the rights, or we were allowed to have virtual machines of all sorts that we completely managed by our own. If we had not local admin access, we would try all sorts of bad "solutions" ...


28

In a rather small department of a larger organization (~100 in department, ~3500 in full organization) we chose an in the middle solution: sysadmins had 2 accounts, one (non administrator even for the local machine) that was used for non administative tasks (mail, document edition, etc.) and one with AD administrator priviledges that was supposed to be only ...


27

In a formal review of an application's security, all libraries should be vetted for security defects. However, this is not the point of OWASP-2013 A9. The core of OWASP-2013 A9 is about having a policies in place to ensure that an application isn't compromised due to negligence. OWASP states the following: Identify all components and the versions you ...


21

First, IANAL. Secondly, this is entirely dependant on your local laws and regulations. PCI-DSS is a guideline, but adherence to the guideline may be a requirement as part of certain laws. I'm not aware of any countries that do this, but in such a case you could be prosecuted if you violate a law that makes PCI-DSS adherence mandatory. The more common case ...


21

SOC 2 Type 2 does not have specific technical requirements. What you have to do is to satisfy your assessor. And if your company cannot satisfy your assessor, then there is a mechanism called "management response" where the company gets to explain away the findings from the assessor. And if your assessor is 4 years behind in their understanding of best ...


20

The initial commit for this code already includes the "80 bits" secret key length. It was not changed afterwards. Now let's analyze things more critically. HOTP is specified in RFC 4226. Authentication uses a "shared secret", which is the value that we are talking about. What does RFC 4226 says about it ? Essentially, there is a a requirement in section 4: ...


20

ISO 27001 does not specify which protocols should be used and how they should be used, it specifies how an organization should structure its information security apparatus. An ISO 27001 certified organization must have policies in place and procedures to make sure the policies are adhered to. ISO 27001 also has a scope which is defined by the organization ...


18

However, if the third party makes a secret copy, then they can covertly sell it for large amounts of money. The thing about this is when it comes to a pivotal and highly-valued asset such as said key, it should never be, created transmitted kept deleted by a third-party vendor. These processes if possible should be done internally. Let's say if you ...


17

Not to pile on too much, but your question exposes a serious flaw in the system, which is you. You are a single point of failure, and that's pretty far from best-practices. Depending on the specifics of this government contract, having all the encryption keys with a single person may be a disqualifying violation, in addition to being poor practice. As ...


16

Storing CVV is not allowed: There are a few things to consider: You assume booking.com is storing CVV You're assuming a CVV is needed to process a transaction. On 1) - there can be no way to confirm whether booking.com, Expedia are storing unless you work there. They would have to answer to a QSA. Now, as far as the CVV that is stored, that is CVV2 ...


16

Companies make promises they can't renege on all the time - that's what a contract is. After all, insurance wouldn't exist if an insurer could wriggle out of paying claims through things like secret policies. That's not to say you can't breach a contract - of course you can, things go to court all the time. But a contract is as binding as anything you can ...


15

Certification companies like SGS, TÜV Rheinland or BSI are accredited by accreditation entities to issue ISO 27001 certificates. For example, SGS and BSI are accredited by UKAS and TÜV Rheinland is accredited by DAR. Accreditation entities perform audits of the certification companies they accredit in order to guarantee that they conform to their ...


14

Standards are general and consist of high level principles. Guides focus on practical security. Checklists are the most detailed documents. There are multiple agencies that produce security standards. One of the most widely used security standards today is ISO/IEC 27002 which started in 1995. This standard consists of three basic parts, BS 7799 part 1, ...


14

A vulnerability is something that leaves you open to the possibility of being harmed. Being prosecuted or sued for violating the law is a form of harm. Therefore, not complying with the law is a vulnerability. It really is this simple.


13

So basically what the requirement is saying is that you need to assign one primary function per server. The server you've described sounds like it runs a few applications for production users to utilize. This would be classified as an "application" server. However, you've also mentioned that there are multiple applications on that server, some touch the CDE ...


13

According to section 4.1 of the PCI Data Security Standard any merchant handling credit card data should: "...use strong cryptography and security protocols such as SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open, public networks.” This means that Front End SSL is allowed, as once the data reaches the LB, it is ...


13

In my experience working for larger organizations, it is absolutely not common for developers to have full rights to anything other than development specific resources. It seems like your organization is on the border of small and large, so... It sounds like it's time for your organization to develop some more mature development practices. To be fair, this ...


12

Certain payment products transfer the burden of PCI compliance to the payment services provider (Authorize.NET or Paypal Pro). However, they require that a consumer be forwarded to the payment provider's servers to complete their order. If your website integrates with Authorize.NET via an API then you are still liable for PCI compliance since your servers ...


12

What you are pointing is the difference between imposing security rules to people and involving people to get better security. Chances are that you will find this video quite interesting. After a walk through issues quite similar to the one you mention, the presenter (Jayson E. Street to name him) ends up by talking about positive enforcement. It makes the ...


12

Here are the basic do's and dont's for PCI-DSS: Regardless of segmentation you are not allowed to store the CVV data. The effectiveness of this code is limited to the ability to keep it out of the hands of criminals, which is why it is prohibited by PCI Standards from being stored. For merchants who charge customers on a recurring basis, the CVV code can be ...


11

The one truism of PCI-DSS compliance is this: You are PCI-DSS compliant if your QSA says you are PSI-DSS compliant. I'm of the opinion that the PCI council did a pretty stinking good job of giving us a very clear and to the point standard to follow, at least as far as standards go. That being said, this is one of those interesting cases where the ...


11

First of all you need to learn that it does not matter what "is common" or "typical" because: typically such situations are handled horribly. You are making the best case for this statement. If local admin access is needed for a person (be it a contractor or an employee) then it is the obligation of the security team/person - whoever is in charge of that ...


Only top voted, non community-wiki answers of a minimum length are eligible