Re:Our security auditor is an idiot. How do I give him the i...
by Zenst on Sunday March 23, 2014 @09:28PM
(#7456161)
WOW, "A security auditor for our servers has demanded the following within two weeks:
•A list of current usernames and plain-text passwords for all user accounts on all servers
•A list of all password changes for the past six months, again in plain-text"
That right there would be a security breach/issue and for it to be created as part of an audit is unbelievable.
I have never met any security auditor who has done that or ever would and having done audits myself for FTSE 100 companies, well if I did that I'd be out of a job. Certainly audit the passwords, though there should be rules to prevent silly passwords and that is what should be audited.
In such a situation I would not panda to such a auditor and would approach a director about the security risk the auditor was and good night veanna for them. Such people should not be doing audits, ever and clearly not qualified in the role/task they have been given.
It would be a security issue too carry on supporting or allowing such a person to carry on auditing as they are clearly a security risk without a doubt.
That right there would be a security breach/issue and for it to be created as part of an audit is unbelievable.
I have never met any security auditor who has done that or ever would and having done audits myself for FTSE 100 companies, well if I did that I'd be out of a job. Certainly audit the passwords, though there should be rules to prevent silly passwords and that is what should be audited.
In such a situation I would not panda to such a auditor and would approach a director about the security risk the auditor was and good night veanna for them. Such people should not be doing audits, ever and clearly not qualified in the role/task they have been given.
It would be a security issue too carry on supporting or allowing such a person to carry on auditing as they are clearly a security risk without a doubt.