Hot answers tagged

5

This will vary according to your business and the transparency you have with your customers. Most of the companies perform tests on their application and share with the customers the standards they have been tested against, but not the "step-by-step" of the testing. For example, let's say you have a web application, you can mention to your customers that ...


3

In a SaaS model, you will likely not be able to perform code audits. This is because as stated, it is Software as a Service. Not software where you would be able to download the software itself, let alone the source code for the software. That task would be done at the discretion of the software vendor, and or provider. Please see "5 Problems with SaaS ...


3

There are some additional points that are worth mentioning: Cons You have to trust Slack team because they have access to all your messages and conversations You need to check that former employees or third people don't have access to your Slack chats (you need an additional robot) Slack servers are available from any device including those security ...


3

Technically the Password-based Single Sign-On from Azure AD (from your link) is not an SSO solution but a password management one. The external application has its own credentials including password, and a plugin installed in the browser types them into an HTML form on behalf of the user, exactly what Lastpass does. That means that those credentials have to ...


2

It sounds like you might qualify for the SAQ A. I would suggest going through the SAQ Instructions and letting it guide you on which SAQ to use. If your business takes credit cards payments, it is required to be PCI compliant. Just because you outsource the payments to another site does not mean you skip the SAQ entirely, but you might qualify for one that ...


2

Short answer - almost no way at all to tell. The question is equivalent to black box probing. You can put certain inputs to the box and get certain results - what exactly is the box doing between input and output? Can't tell. What other processes or devices have access to the same storage devices? Can't tell. The "almost" is because there may be sideband ...


2

Azure B2C is completely a PaaS service, no way/need to host this onpremise. Both handle the users and the login screens. Regarding B2C vs ADFS: B2C is for all external customers. ADFS is a wrapper around your corporate AD, so that is not so suitable for external customers.


2

Short answers : 1.) no not a requirement 2.) yes via authenticated client browsers being manipulated. SilverlightFox is correct in that the crossdomain.xml is not a web application requirement. Per Adobe's website the crossdomain.xml is a policy in the form of an XML file which "grants a web client, such as Adobe Flash Player or Adobe Acrobat (though not ...


2

There're 3 elements you need to take in place with the business model you describe: Amazon needs to be PCI compliant because they operate the infrastructure behind companies that accept debit, credit or pre-paid cards. No worries here because, as a matter of fact, Amazon is PCI Compliant (https://aws.amazon.com/es/compliance/pci-dss-level-1-faqs/) Your ...


2

If you want to protect the program, then running it as a service, rather than distributing the code is a normal way to go about that. Make sure you know how to properly secure the service though and that you properly secure the data in transit, and consider availability issues (performance due to load/distance from the user; what happens if it does). ...


2

It is impossible to guarantee security in the cloud from the cloud provider itself, the cloud provider can (be forced to) take a memory dump of any running VM instance and extract any encryption key from a running instance. It is even possible to continuously and automatically monitor a running VM and extract AES keys as soon as they are used, especially ...


2

TL;DR: Rate limiting is your only option. As you are going to have mobile apps and websites as API clients, you will be sending the API key/secret to client devices - including ones potentially controlled by an attacker. You can never rely on the confidentiality of these keys for security decisions. They are just too easily compromised. Sure you can ...


2

You are missing one important point: It is way easier to exploit a public API. It's relatively easy for a sophisticated attacker to work around rate-limiting. If there is any kind of vulnerability, like SQLi or XXE, it will be detected and abused pretty fast by automated tools, and the abuse will not be traceable to a specific user, if there aren't any.


2

Is any of the two positions above horribly wrong or would be laughed at if presented on the market of serious APIs? Considering the data that is returned from the API is public information I do not really see why authentication is required, assuming your statement "The moot point is whether the API should require authentication for what is essentially ...


1

REF: https://www.fedramp.gov/faqs/ It looks to me like you need to have everything authorized. If an Agency purchases an outsourced service (software) that is built on top of a cloud platform, how is that handled within FedRAMP? Obtaining a FedRAMP authorization requires all system components be assessed based on the control requirements in the ...


1

IPSEC is not focusing data safety without sub-protocols. You can review ESP, AH, IKE sub-protocols for a better comparison with SSL/TLS. Yes they have both same goal but with tunnel you will have some management capabilities which are listed below. they can access your server with a private ip space (so they will not whitelist your application domain ...


1

Is this attack acceptable, or at least common among large enterprise systems? No, this is absolutely not acceptable at all. And I do hope it is not common. I believe wrapping user-generated content in an iframe with the sandbox attribute would block this attack (provided admins use up-to-date browsers), by using CORS to prevent requests to the REST API. ...


1

I think there is some confusion here. The point of a VPN is to bridge a device into a LAN, so that internal resources can be (securely) accessed from an external network. While some companies market VPNs as a kind of security or privacy tool, this is not their intended use at all, and the security benefits are questionable - ultimately you're just sending ...


1

Don't think this is possible with symmetric keys if you expect the server to accept clear-text data and then encrypt it; only keeping the encryption key in memory during the session isn't really a protection of the data, as (for a relatively busy service) that key will be in memory, thus the data vulnerable to decryption, all the working day. It could be a ...


1

I can think of following scenarios: Safety against SQL injection and login related attacks if your software has user accounts The accuracy and robustness of your access control if your software has users


Only top voted, non community-wiki answers of a minimum length are eligible