Unable to load image

Our security auditor is an idiot. How do I give him the information he wants? (Server Fault, 2009)

https://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants

As explained, this information should be easily available on any well maintained system to any competent administrator. Your failure to be able to provide this information leads me to believe you are aware of security flaws in your system and are not prepared to reveal them. Our requests line up with the PCI guidelines and both can be met. Strong cryptography only means the passwords must be encrypted while the user is inputting them but then they should be moved to a recoverable format for later use.

:marseyxd#:

119
Jump in the discussion.

No email address required.

There are a lot of people in the security space that have no idea what they are doing. I call myself an amateur and was lucky to learn under CISOs for some well known companies and some pretty well known security researchers who know what they are doing. I learn something new all the time from them.

I just did something for a client and read their pen-test report and it wasn't bad but some of the things they put as "proof" that things are fine are not really proof at all. Like forcing the application to go to HTTPS isn't full proof of sufficient TLS but I'm not an expert either so I keep my mouth shut.


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp https://i.rdrama.net/images/17156480765435808.webp

Jump in the discussion.

No email address required.

Most important lesson I learned in college was my Operating Systems professor who said "The thing about Computer 'Science' is that it's all made up. Physicists can't change the law of Gravity". The blind are leading the blind everywhere.

Jump in the discussion.

No email address required.

I call myself an amateur and was lucky to learn under CISOs for some well known companies and some pretty well known security researchers who know what they are doing.

I'm not an expert either so I keep my mouth shut.

So you didn't learn anything.

Love it.

Jump in the discussion.

No email address required.

oh look it's my peepee rider.


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp https://i.rdrama.net/images/17156480765435808.webp

Jump in the discussion.

No email address required.

Keep dreaming sweaty.

![](https://media.giphy.com/media/P8MxmGnjmytws/giphy.webp)

Jump in the discussion.

No email address required.

admit it, you lovvvvvvve to rageface at my posts. You always reply. I'm going to keep you as my pet.

![](/images/16766669054684675.webp)


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp https://i.rdrama.net/images/17156480765435808.webp

Jump in the discussion.

No email address required.

I honestly have no idea who you are.

Also I'm a top.

Jump in the discussion.

No email address required.

No such thing as a Euro top, stop lyin.


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp https://i.rdrama.net/images/17156480765435808.webp

Jump in the discussion.

No email address required.

Born and raised in Ohio bb.

Midwest cob here :#marseycornlove::#marseycornlove::#marseycornlove:

Jump in the discussion.

No email address required.

I recently finished up a project with some fintech firm where the infosec engineer they saddled me with couldn't linux, couldn't vim, and both the engineer and their infosec director complained that I spent too much time teaching them cli stuff and not enough time on clicking shit in the UI.

Jump in the discussion.

No email address required.

I think the problem is that SMBs have no direction on who is a good hire in this space. Developers often think they are hackers, but you see their pen-test report and it's obvious most developers don't know hacking at all. lol So how do you hire a good security guy if you can't hire some FAANG CISO guy but need someone who can help with security?

You see that in the dev space too where SMBs can't afford a good dev so now it's 10 years later and the guy in charge of development built all tables with MS Access. lol


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp https://i.rdrama.net/images/17156480765435808.webp

Jump in the discussion.

No email address required.

It's all just varying degrees of hackability with no real actual proof you've done it right.

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.