3 ms·
I don't think it matters how much money a company spends on security, it'll get hacked if there's strong incentive for that event to occur. Basically, if you're
by smtddr 13y ago
I don't think it matters how much money a company spends on security, it'll get hacked if there's strong incentive for that event to occur. Basically, if you're popular... just assume you'll be hacked one day. I think there are only really 2 things you can do.
1. Just make sure the hack isn't something embarrassingly easy like SQL injection in the username/password field. If you get hacked, make sure the hacker had to do something really clever that any developer would go "whoa, that's not an exploit I see everyday..."
2. Assume a hacker got a bash shell to your system and apply the next level of security there. Salted hashes, PGP encryption on any sensitive data. Make sure the salt isn't sitting there in plain view and if pub/priv key, make sure the private-key isn't just sitting there on the same system without a passphrase.
- GuiA 13y agoI agree with you, but spending some money on security auditing is a pre-requisite for 1) to happen :)
- adrr 13y agoGood advice. I'll add one more thing. If you're dealing with credit cards, the private key should be on a hardware security device with the only backups stored on a couple USB sticks sitting in a safety deposit box at a bank.
- GuiA 13y agoIf you're dealing with credit cards, you have much more to do than that: http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...
- adrr 13y agoWell thats a given since your merchant bank and processor will force you to be PCI compliant including annual reviews. PCI compliance doesn't specify where your private key is stored just that your data is in a "unreadable" state and that you have certain key management procedures in places. For example, hashing your credit cards is acceptable though it can easily be brute forced since its just 16 digit number and the six digit prefix set(BIN) is already known.