3 ms·

Unfortunately almost every time I've dealt with PCI-DSS compliance auditors they almost always raise the fact that I haven't got ICMP completely filtered. It's

• OSButler 11y ago
  Most annoying instance I've experienced with PCI compliance was with an auditor who didn't understand the concept of patching. Even after providing the full list of backported CVEs, which clearly showed the one he insisted was missing on the system, he still refused to pass it. Only after escalating the issue was it finally marked as passed.
  • vidarh 11y ago
    I've had that too - the only thing the auditor in question cared about was the version number that their run of nmap had guessed.
• vidarh 11y ago
  Not PCI-DSS, but I dealt with security auditors for a client that insisted that we shouldn't allow ping... To the address of the public website... Because we might reveal there was something there. My passive aggressive response was to point out, while copying the client, that a number of more prominent security auditors sites responded to ping, as well as the websites of any number of intelligence organizations, banks and similar.
  • MichaelGG 11y ago
    Just had an audit with one of the biggest telcos, done by a large "security" firm. They insisted that the public website not respond unless the right Host header was there. Stupid, but OK, I can see it on a checklist for intranet apps. But the real kicker: The site was TLS only, so connecting to the IP will still leak the hostname, from the cert. Edit: This was a really big security firm, too. Totally worthless audit. They actually complained that a site admin could "include iframes in the HTML, which could be a malware vector" when uploading content. Ignoring that they could also upload scripts and arbitrary binaries. After their weeklong "penetration test" concluded, I found some serious XSS (public user->admin, which could easily turn into system takeover) with about 5 minutes of looking. Are most audits this useless?
    • strayptr 11y ago
      After their weeklong "penetration test" concluded, I found some serious XSS (public user->admin, which could easily turn into system takeover) with about 5 minutes of looking. Are most audits this useless? Hiya! I started at Matasano/NCC back in February. Part of the reason I joined was to find out whether or not everything tptacek has been saying for years is true. Turns out it's pretty much all true. Some of that is awesome, like the hiring process. Some of that is scary, like the fact that someone of moderate skill level can usually break into most production apps. My experience is limited. That said, put me on an audit and the first thing I'll check for is XSS and SQLi. The second thing I'll check for is authz: log into an admin account, note a URL to perform an admin action, log in as a normal user, try to access that URL. Third thing I'll check for is if there are any upload forms, because that's a common way to get RCE: upload a file and try to trick the app into executing it. Etc. Stuff that matters. It's a point of pride to ensure that our assigned app has been pentested thoroughly by the conclusion of an audit. A thorough pentest doesn't necessarily mean finding every possible vulnerability, because time is often limited, but it does mean finding the serious ones. If we include any findings in the final report which could be called "trivial" (there are occasionally some), they're marked as informational findings, i.e. their severity level is less than low. The reason we include them is because even though the finding doesn't necessarily pose any security risk, a client will often get another pentest from another security firm and diff the results. If the other firm points out something we thought was too trivial to include, the client will rightfully ask why we didn't find it. (We try to be pretty clear in the report about each finding, though, so you're not going to come away with the impression that we're saying you need to address something trivial.) I don't know enough about your experience with that security firm you worked with to comment directly, but communication is one of the most important aspects of the job. If we find some flaws but don't communicate well to the client, then nobody was served by the audit. So if you're feeling like the whole process was a waste of time, you might want to shop around. There are several good security firms, not just Matasano/NCC, so you may want to give it another shot. For what it's worth, the fact that you had a bad experience with one of the firms is actually painful to me. It's only recently that people started to care about security in a significant way, and it's a tenuous position. The more people who get a "security audit" and end up feeling like it was a waste of time, the more likely we are to end up back in a situation where people know there are probably serious security problems but feel like there's nothing they can do to find or fix them. There is: Give us a test environment and two weeks. We'll find what matters, and we'll give you a report explaining each issue and how to fix them.
  • api 11y ago
    There's more cargo cultism in security than pretty much any other field of CS/IT that I am aware of. "Best practices" are cargo culted with zero understanding as to why they exist. "If firewall equals secure, then MOAR firewall equals more secure!" Blocking ICMP, of course, makes the firewall more firewally. I try to explain that (a) firewalls are practically useless alone since most threat vectors today are "pulled" not "pushed," and (b) things need to actually work... but nope. Unfortunately in security black hats tend to be more skilled than (most) white hats. Really good security people are some of the most knowledgeable people I've met, but there don't seem to be many of them. They also tend to be terrible salespeople (like most techies), so the bad checkbox-ticking "security firms" are the ones who get enterprise contracts.