4 ms·
From my random perusal of the various reports of compromises over the last few years, my impression is not that organisations tend to get hacked using the lates
by mnw21cam 9y ago
From my random perusal of the various reports of compromises over the last few years, my impression is not that organisations tend to get hacked using the latest zero-day vulnerability, but rather that organisations get hacked because they have glaring security holes that you could drive a double-decker bus through.
For example, bcrypt has been around for how long now? And don't almost all the reports of hacks report that a database was lifted with usernames and passwords either in plaintext (for the love of all that is holy) or hashed with unsalted SHA1, or similar?
- jrimbault 9y agoI think most "hacks" have been the results of social engineering and misconfigurations rather than software/hardware vulnerabilities.
- talmand 9y agoI keep plaintext passwords, but I reverse the string to prevent the hackers.
- gkya 9y agoI wish there was a "web security checklist" where if you ticked all the boxes, you can be pretty sure you have the well-known holes covered. This is why web frameworks are really useful, the decent ones get you way ahead in securing your application from the most common attacks. But if you self-bake, then you have to manage the entire complexity of the web platform.
- nicoburns 9y agoThis doesn't cover everything, but it's a pretty good starting point: https://stackoverflow.com/questions/549/the-definitive-guide-to-form-based-website-authentication https://stackoverflow.com/questions/549/the-definitive-guide...
- deejaybog 9y agoOWASP top 10 is as close as it gets to a checklist: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...
- npsimons 9y ago> I wish there was a "web security checklist" https://www.owasp.org/index.php/Main_Page https://www.owasp.org/index.php/Main_Page https://www.stigviewer.com/stig/database_security_requirements_guide/ https://www.stigviewer.com/stig/database_security_requiremen...