115

Here's one data point from a software company that has an interest in security. I know this is common in similar organisations. There is a number of networks. They are physically separated and airgapped, run different colour-coded network cables. Each employee has an 'administration' machine, which can connect to the Internet (via a proxy) for doing email ...


70

In my experience, it is common for developers to have admin access on their own machines. It is also common for them not to have admin access on their own machines. However, in the latter situation some accommodation is generally made so they can get their jobs done without too much friction. One very common accommodation is access to a Hypervisor on the ...


53

The request for this information may not only be for a security audit, but also a process audit, and it sounds like it might be well founded, since: If you wanted to break into their portion of this system, you come after me. What would happen if you were "hit by a truck" tomorrow? If you are the only one that knows the systems, your clients and theirs ...


48

I work for a fairly large investment management firm (~6000 employees) and developers are one of the groups that we approve for local admin access. We tell them not to install any software, as that is handled by local desktop/software compliance. We also have a Developers AD Group that allows members to change the execution policy on their machines without ...


35

I don't know of any technical security impact relating to not adhering to EU cookie laws. Ultimately I think this is mostly down to the discretion of the assessor and the context of the assessment. Privacy issues are security-adjacent and come with similar PR impacts, and may even be judged to infringe upon the rights of the individual, so I think in some ...


32

In my experience allowing and disallowing local admin access is common, just as common as dirty workarounds for the latter. - So you should ask yourself: Which threat to your network is made worse by local admin rights? To which the answer shoud be: NONE - The access to resources in your network should be restricted on a per user basis, completely ...


30

You said "Very little of this stuff is actual legal requirement" but depending on which government this concerns, this may be a very strict legal requirement. If that government requires their departments/agencies to follow NIST SP800-53 then they can't just answer "we have a guy." The answers to these security controls require detailed information giving ...


30

In my career, with rather small companies (less than 100 people), we always had local admin rights. We either have real desktop machines which are maintained by IT, but got the rights, or we were allowed to have virtual machines of all sorts that we completely managed by our own. If we had not local admin access, we would try all sorts of bad "solutions" ...


29

In a rather small department of a larger organization (~100 in department, ~3500 in full organization) we chose an in the middle solution: sysadmins had 2 accounts, one (non administrator even for the local machine) that was used for non administative tasks (mail, document edition, etc.) and one with AD administrator priviledges that was supposed to be only ...


27

In a formal review of an application's security, all libraries should be vetted for security defects. However, this is not the point of OWASP-2013 A9. The core of OWASP-2013 A9 is about having a policies in place to ensure that an application isn't compromised due to negligence. OWASP states the following: Identify all components and the versions you ...


21

The initial commit for this code already includes the "80 bits" secret key length. It was not changed afterwards. Now let's analyze things more critically. HOTP is specified in RFC 4226. Authentication uses a "shared secret", which is the value that we are talking about. What does RFC 4226 says about it ? Essentially, there is a a requirement in section 4: ...


21

SOC 2 Type 2 does not have specific technical requirements. What you have to do is to satisfy your assessor. And if your company cannot satisfy your assessor, then there is a mechanism called "management response" where the company gets to explain away the findings from the assessor. And if your assessor is 4 years behind in their understanding of best ...


20

ISO 27001 does not specify which protocols should be used and how they should be used, it specifies how an organization should structure its information security apparatus. An ISO 27001 certified organization must have policies in place and procedures to make sure the policies are adhered to. ISO 27001 also has a scope which is defined by the organization ...


18

However, if the third party makes a secret copy, then they can covertly sell it for large amounts of money. The thing about this is when it comes to a pivotal and highly-valued asset such as said key, it should never be, created transmitted kept deleted by a third-party vendor. These processes if possible should be done internally. Let's say if you ...


17

Not to pile on too much, but your question exposes a serious flaw in the system, which is you. You are a single point of failure, and that's pretty far from best-practices. Depending on the specifics of this government contract, having all the encryption keys with a single person may be a disqualifying violation, in addition to being poor practice. As ...


16

Storing CVV is not allowed: There are a few things to consider: You assume booking.com is storing CVV You're assuming a CVV is needed to process a transaction. On 1) - there can be no way to confirm whether booking.com, Expedia are storing unless you work there. They would have to answer to a QSA. Now, as far as the CVV that is stored, that is CVV2 ...


16

Companies make promises they can't renege on all the time - that's what a contract is. After all, insurance wouldn't exist if an insurer could wriggle out of paying claims through things like secret policies. That's not to say you can't breach a contract - of course you can, things go to court all the time. But a contract is as binding as anything you can ...


15

Certification companies like SGS, TÜV Rheinland or BSI are accredited by accreditation entities to issue ISO 27001 certificates. For example, SGS and BSI are accredited by UKAS and TÜV Rheinland is accredited by DAR. Accreditation entities perform audits of the certification companies they accredit in order to guarantee that they conform to their ...


14

A vulnerability is something that leaves you open to the possibility of being harmed. Being prosecuted or sued for violating the law is a form of harm. Therefore, not complying with the law is a vulnerability. It really is this simple.


13

According to section 4.1 of the PCI Data Security Standard any merchant handling credit card data should: "...use strong cryptography and security protocols such as SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open, public networks.” This means that Front End SSL is allowed, as once the data reaches the LB, it is ...


13

In my experience working for larger organizations, it is absolutely not common for developers to have full rights to anything other than development specific resources. It seems like your organization is on the border of small and large, so... It sounds like it's time for your organization to develop some more mature development practices. To be fair, this ...


12

What you are pointing is the difference between imposing security rules to people and involving people to get better security. Chances are that you will find this video quite interesting. After a walk through issues quite similar to the one you mention, the presenter (Jayson E. Street to name him) ends up by talking about positive enforcement. It makes the ...


12

Here are the basic do's and dont's for PCI-DSS: Regardless of segmentation you are not allowed to store the CVV data. The effectiveness of this code is limited to the ability to keep it out of the hands of criminals, which is why it is prohibited by PCI Standards from being stored. For merchants who charge customers on a recurring basis, the CVV code can be ...


11

First of all you need to learn that it does not matter what "is common" or "typical" because: typically such situations are handled horribly. You are making the best case for this statement. If local admin access is needed for a person (be it a contractor or an employee) then it is the obligation of the security team/person - whoever is in charge of that ...


11

That's not how this works. You don't collect certificates. being certified does not mean that you are secure customers only care about the certificates they care about The "best" certification is the one that serves your company's goals the best. If you pursue Cyber Essentials, but your customers want BSI Grundschutz, then you have wasted a lot of time ...


10

By FIPS, I assume you mean FIPS 140. FIPS 140 defines four levels of security. Level 1 is essentially about implementing cryptography and authentication correctly, as in passing some basic functional tests. You must use approved algorithms for cryptography and for random number generation. You can certify a software product at level 1. Levels 2 and above ...


10

HIPPA isn't a certification, it is a set of regulations for proper handling of personal health information. The requirements vary based on what your role is and what data you handle. I would recommend visiting the Health Information Privacy section of the Health & Human Services site for more info. It also might not hurt to hire someone to evaluate ...


10

Is it standard practice to conduct a security review of Microsoft's own code base when you build an app on the Microsoft stack? No. One reason being is that you will not have access to proprietary (Windows, IIS, .Net, patches) code unless you reverse engineer it and the effort of it would outweigh the benefits. The common approach is to define trusted ...


9

(Disclosure, I work for Braintree, a competitor to Stripe) At Braintree we also allow the CVV code to be passed in our API. You are correct that the PCI-DSS explicitly forbids non-issuers from storing the CVV. You are allowed to hold the code temporarily while waiting for the charge to be authorized. This is stated in PCI-DSS Requirement 3.2 (additional ...


Only top voted, non community-wiki answers of a minimum length are eligible