4 ms·
Should being part of a CA include having a red team constantly trying to breach things?
by cordite 10y ago
Should being part of a CA include having a red team constantly trying to breach things?
- ethbro 10y agoOr more specifically, do security auditors have red teams authorized as part of their audit?
- thenewwazoo 10y agoIn my limited experience (infosec for a big 4 firm), the answer is no. The audits are done as cheaply and as quickly as possible. I worked alone, in fact, and essentially did process testing (read: document review).
- raesene6 10y agoIt's a plausible suggestion that all services that provide basic critical infrastructure for the Internet (e.g. DNS, Certificate Authorities, ISPs and network providers) should have a very high level of security testing given their attractiveness to attackers. the only problem is... who's going to pay for it? the CA model and the DNS model tend to be a very low-cost one which means there's unlikely to be the kind of money available to pay for expensive red-teaming on a regular basis, let alone running infrastructure that would resist their attacks..
- tptacek 10y agoShould it be? Yes. Is it? No.
- thingexplainer 10y agoWhen will it be?
- brazzledazzle 10y agoWhen enough people are screwed by it to justify the requirement which will justify the resultant cost increases.