4 ms·

> where would be a good place to source security experts? There's no universal good answer for this. I spend a lot of time on ##crypto (irc.freenode.net), and

> where would be a good place to source security experts? There's no universal good answer for this. I spend a lot of time on ##crypto (irc.freenode.net), and a lot of smart folks hang out there. Some are very well connected to other security experts in their own isolated communities. However, there are undoubtedly silos of security expertise that remain untapped if you rely on just IRC. You could also find folks who talk about security here on HN and follow their Twitter accounts (if public). You could try "[development stack] security expert" in a Google search, as a last resort. (My company's currently at the bottom of the first page for PHP, although that's likely only true because of our filter bubble.) A diverse approach is probably most likely to succeed here.

web007 10y ago
It's the same concept as auditors, there's the big 4 that you've probably heard of, and a ton of other, smaller firms with varying quality. You could go with a known firm like iSec Partners, Matasano (now NCC) or Mitnick Security. They won't be cheap - at worst they may be able to refer you to some other reputable firm if your budget is limited.
- CiPHPerCoder 10y ago
  > or Mitnick Security Please no. Not Mitnick. I'd rather funnel clients towards my competitors than Kevin Mitnick. He's a skilled social engineer, and his greatest social engineering success was manipulating the media into believing he speaks for hackers in general. He is not a programmer, his opinions on cryptography aren't insighful, etc. His only skill is deception.
  - ethbro 10y ago
    To be fair, are we assuming op's server wasn't compromised through deception? Smart play is usually the easiest path to a goal...
  - web007 10y ago
    Regardless of your opinion of The Man Himself, the company employees people that are good at things beyond social engineering. I've seen two separate engagements with them (one as a 3rd party and one as technical contact), and both found significant non-trivial vulnerabilities that needed to be patched.
    - CiPHPerCoder 10y ago
      I can't speak towards the efficacy of his staff, but that testimonial is generally true of any engagement with most security teams.
  - nickpsecurity 10y ago
    A nice example is when I used to point out OpenVMS security benefits. Better architecture, higher quality focus, and few things running by default led to fewer vulnerabilities and more containment than competing systems. At least one person always had a recurring counterpoint: "but didnt Mitnick hack all kinds of VMS systems?" If by hack, you mean use conned or password-guessed credentials to get in... Not my definition of the word.

web007 10y ago

It's the same concept as auditors, there's the big 4 that you've probably heard of, and a ton of other, smaller firms with varying quality. You could go with a known firm like iSec Partners, Matasano (now NCC) or Mitnick Security. They won't be cheap - at worst they may be able to refer you to some other reputable firm if your budget is limited.

CiPHPerCoder 10y ago
> or Mitnick Security Please no. Not Mitnick. I'd rather funnel clients towards my competitors than Kevin Mitnick. He's a skilled social engineer, and his greatest social engineering success was manipulating the media into believing he speaks for hackers in general. He is not a programmer, his opinions on cryptography aren't insighful, etc. His only skill is deception.
- ethbro 10y ago
  To be fair, are we assuming op's server wasn't compromised through deception? Smart play is usually the easiest path to a goal...
- web007 10y ago
  Regardless of your opinion of The Man Himself, the company employees people that are good at things beyond social engineering. I've seen two separate engagements with them (one as a 3rd party and one as technical contact), and both found significant non-trivial vulnerabilities that needed to be patched.
  - CiPHPerCoder 10y ago
    I can't speak towards the efficacy of his staff, but that testimonial is generally true of any engagement with most security teams.
- nickpsecurity 10y ago
  A nice example is when I used to point out OpenVMS security benefits. Better architecture, higher quality focus, and few things running by default led to fewer vulnerabilities and more containment than competing systems. At least one person always had a recurring counterpoint: "but didnt Mitnick hack all kinds of VMS systems?" If by hack, you mean use conned or password-guessed credentials to get in... Not my definition of the word.