3 ms·

From the limited information i have on this, i'd say they don't know/care about those discussions. Hopeless engineers? Engineering department that find manageme

by drtse4 15y ago

From the limited information i have on this, i'd say they don't know/care about those discussions. Hopeless engineers? Engineering department that find management in their way? Hard to tell, but considering how basic this stuff is i'd go for the last one.

happyfeet 15y ago
Question for experts: Is a PCI DSS certification supposed to take care of aspects like plain text passwords or credit card info & such vulnerabilities as well? Gist of what I find in wikipedia is this: PCI DSS Requirements: Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software on all systems commonly affected by malware 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need-to-know 8. Assign a unique ID to each person with computer access 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security
- drtse4 15y ago
  I've just read the wikipedia entry (http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...), sadly it smells like CMMI.
  - kamaal 15y ago
    How does that justify not using one's brain? Well the problem is simple. Some things break or get messed up. Now a root cause analysis is done and its found if a particular thing had been taken care of, the problem would have been avoided. So now what is the step taken? The solution to the root cause analysis is put as a 'checklist' and now applied to everything or when something is done. And this is put in as a process. Do this, do that... every time you deploy or code something. Now here comes the problem, the people who write the checklist understand that its only a guidance rather than a compliance document. People who come later or those who don't think take the both the process and checklist as some sort of document which if you adhere to, your job is done. And anything and everything else can be done without proper testing or thinking. This goes on until something breaks again, root cause is now found and it goes into that checklist. Its this sort of approach to technology and programming that is creating all the problems in software today. No certification can fix this problem.
kamaal 15y ago
The problem might be 'Hopeless Engineers' as you term it. I don't think certifications can correct people who do it just to get a job. The general way of passing certification by the masses is to get dumps of previous years questions from the internet or friends. Read the the book, mug it up as much as you can. Read the questions and clear the certification. This is bad, very bad in fact. Its amazing things like this happen from time to time, even things like storing passwords in plain text. This goes on to show only two things, either utter negligence and lack of seriousness on the part of designers or just that they are not aware of even the very basics of computer security. Engineers passing out of colleges with just degrees and some out side memorized bookish knowledge. Copy pasting snippets of code from the internet when they are asked to write code. Just doing minimal feature compliance tests. Lack of idea of seriousness of jobs they are doing. Failure to understand the overall architecture. And hopping jobs when this sort of things happen. A ideal approach to computer science security is to have professionals obtain licenses. All people working on security must obtain a license. And failing on things like this must attract penalties and punishments.
- happyfeet 15y ago
  @kamaal, I think you have misunderstood what it means by certification in this context. We are referring to the PCI DSS certification for the application / website itself & not for the engineers who work on it.
  - abdulqabiz 15y ago
    @happyfeet, most of Indian companies have certifications (ISO and whatever), in practice how many follow things? I am not sure how they got PCI DSS, but I know - how easy it is to get ISO XXXX certifications. Certification doesn't mean anything. In reality, whatever it takes to protect data, companies should do that; Even if it means doing things, which is not written in books. @kamaal, I agree with you. CCAvenue must have had these since it's first version, they were fortunate no one ever tried sql-injection attacks on them. It looks like either CEO is not technical or he is misinformed or engineers who implemented have no idea about hashing, encryption and other terms. I bet, most freshers or even experienced engineers here in India, would not know about sql-injection and storing passwords as hashes. Having said that, there are brilliant guys here as well, hence all those R&D centers of Y!, Google, et al.

by drtse4 15y ago

happyfeet 15y ago

Question for experts: Is a PCI DSS certification supposed to take care of aspects like plain text passwords or credit card info & such vulnerabilities as well? Gist of what I find in wikipedia is this: PCI DSS Requirements: Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software on all systems commonly affected by malware 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need-to-know 8. Assign a unique ID to each person with computer access 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security

drtse4 15y ago
I've just read the wikipedia entry (http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...), sadly it smells like CMMI.
- kamaal 15y ago
  How does that justify not using one's brain? Well the problem is simple. Some things break or get messed up. Now a root cause analysis is done and its found if a particular thing had been taken care of, the problem would have been avoided. So now what is the step taken? The solution to the root cause analysis is put as a 'checklist' and now applied to everything or when something is done. And this is put in as a process. Do this, do that... every time you deploy or code something. Now here comes the problem, the people who write the checklist understand that its only a guidance rather than a compliance document. People who come later or those who don't think take the both the process and checklist as some sort of document which if you adhere to, your job is done. And anything and everything else can be done without proper testing or thinking. This goes on until something breaks again, root cause is now found and it goes into that checklist. Its this sort of approach to technology and programming that is creating all the problems in software today. No certification can fix this problem.

kamaal 15y ago

The problem might be 'Hopeless Engineers' as you term it. I don't think certifications can correct people who do it just to get a job. The general way of passing certification by the masses is to get dumps of previous years questions from the internet or friends. Read the the book, mug it up as much as you can. Read the questions and clear the certification. This is bad, very bad in fact. Its amazing things like this happen from time to time, even things like storing passwords in plain text. This goes on to show only two things, either utter negligence and lack of seriousness on the part of designers or just that they are not aware of even the very basics of computer security. Engineers passing out of colleges with just degrees and some out side memorized bookish knowledge. Copy pasting snippets of code from the internet when they are asked to write code. Just doing minimal feature compliance tests. Lack of idea of seriousness of jobs they are doing. Failure to understand the overall architecture. And hopping jobs when this sort of things happen. A ideal approach to computer science security is to have professionals obtain licenses. All people working on security must obtain a license. And failing on things like this must attract penalties and punishments.

happyfeet 15y ago
@kamaal, I think you have misunderstood what it means by certification in this context. We are referring to the PCI DSS certification for the application / website itself & not for the engineers who work on it.
- abdulqabiz 15y ago
  @happyfeet, most of Indian companies have certifications (ISO and whatever), in practice how many follow things? I am not sure how they got PCI DSS, but I know - how easy it is to get ISO XXXX certifications. Certification doesn't mean anything. In reality, whatever it takes to protect data, companies should do that; Even if it means doing things, which is not written in books. @kamaal, I agree with you. CCAvenue must have had these since it's first version, they were fortunate no one ever tried sql-injection attacks on them. It looks like either CEO is not technical or he is misinformed or engineers who implemented have no idea about hashing, encryption and other terms. I bet, most freshers or even experienced engineers here in India, would not know about sql-injection and storing passwords as hashes. Having said that, there are brilliant guys here as well, hence all those R&D centers of Y!, Google, et al.