4 ms·
Reminds me of the famous "Our security auditor is an idiot. How do I give him the information he wants? [1] [1] https://serverfault.com/questions/293217/our-se
by sam_lowry_ 7mo ago
Reminds me of the famous "Our security auditor is an idiot. How do I give him the information he wants? [1]
[1] https://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants https://serverfault.com/questions/293217/our-security-audito...
- rcxdude 7mo agoIs there some part of PCI auditing requirements that is getting misinterpreted by some auditors to demand this? Though in my experience with standards like this what auditors want to see and what the standards say often have only loose overlap anyhow.
- SpicyLemonZest 7mo agoIt's pretty counterintuitive from an auditing perspective. If the PCI standards require server racks to be painted red, it's entirely normal for an auditor to ask to see them, and very suspicious for you to say that they're in an encrypted box where nobody can check if they're red or not. I don't mean to excuse it, but I can understand how the error happens.
- rcxdude 7mo agoThis is true. Maybe it's someone seeing a requirement like "all passwords must conform to these rules" and deciding that it means they need to check them directly, instead of looking at the systems that enforce that constraint.
- zvqcMMV6Zcr 7mo agoThat is crazier than any old dailywtf stories, and that site felt like everyone tried to one-up each other.
- samus 7mo agoRight until the end I thought the guy was doing a social engineering penetration test, checking whether he could brow beat the server admins into bending over backwards to reveal this information.