News for hackers. Stuff that matters.

A comment on Our security auditor is an idiot. How do I give him the information he wants?.

Re:Our security auditor is an idiot. How do I give him the i... by rdl on Sunday March 23, 2014 @09:34PM (#7456182)
The last time this got discussed, I thought the consensus was he was trolling -- the point being the correct answer is to explain why you don't have these (technical controls, hashing of passwords, etc.).

The other reason would have been if he wanted login access to servers to validate configs himself, but there are much better ways to accomplish that (I'd be very reluctant to give an auditor anything but read-only access to any production infrastructure, but it is valid to want to know that what is being given to you matches production; there are ways to accomplish both).

[ Parent | on HN ]
Re:Our security auditor is an idiot. How do I give him the i... by wernercd on Sunday March 23, 2014 @09:49PM (#7456232)
From the follow ups that were posted, it sounds like the "Auditor" wasn't trolling. (Assuming the OP is/was on the up-and-up)

And this is a blast from the past... July 2011. Almost 3 years ago.

[ Parent | on HN ]