{"id":3249,"date":"2011-07-28T09:58:16","date_gmt":"2011-07-27T23:58:16","guid":{"rendered":"http:\/\/nsrd.info\/blog\/?p=3249"},"modified":"2018-12-11T14:58:42","modified_gmt":"2018-12-11T04:58:42","slug":"auditing-should-be-done-only-by-the-experts","status":"publish","type":"post","link":"https:\/\/nsrd.info\/blog\/2011\/07\/28\/auditing-should-be-done-only-by-the-experts\/","title":{"rendered":"Auditing should be done only by the experts"},"content":{"rendered":"

I’ve said it before \u2013 auditing should only be done by the experts. I first realised this when a security auditor from one of the (then) “Big 5” accounting companies audited the Solaris servers I was administering 11 years ago. Having checked \/etc\/passwd, the auditor noted in the report:<\/p>\n

All user passwords are set to *, which is highly insecure and should be addressed immediately to ensure continued security compliance.<\/p><\/blockquote>\n

The fallout from that was briefly atrocious, and resolved only by convincing a manager to try to log onto a list of user accounts using * as the password.<\/p>\n

It appears that there’s still room for security auditors who don’t really understand security, as evidenced by “Our security auditor is an idiot, how do I give him the information he wants? – Server Fault<\/a>“. The system administrator was told he had to handover the following as part of the audit:<\/p>\n

\n
    \n
  • A list of current usernames and plain-text passwords for all user accounts on all servers<\/li>\n
  • A list of all password changes for the past six months, again in plain-text<\/li>\n
  • A list of “every file added to the server from remote devices” in the past six months<\/li>\n
  • The public and private keys of any SSH keys<\/li>\n
  • An email sent to him every time a user changes their password, containing the plain text password<\/li>\n<\/ul>\n<\/blockquote>\n

    Up until this point, I thought that it would be impossible for anyone to have an experience to trump my “all user passwords are set to *” experience.<\/p>\n

    It turns out I was wrong.<\/p>\n

    What’s this got to do with backups, I hear you ask?<\/p>\n

    Well, everything. If your company is getting in auditors who aren’t subject matter experts (or at least product experts), then your audit isn’t worth the paper it’s written on. Maybe you’ll get a compliance rubber stamp. Maybe you won’t. But it won’t make one iota of difference as to whether there’s been any valid checking of your environment.<\/p>\n

    Please, ensure that if you want your backups audited you ask some experts in. Knowing the sorts of prices the “big” auditing companies charge, it’ll likely not only cost you less, but actually give you more!<\/p>\n","protected":false},"excerpt":{"rendered":"

    I’ve said it before \u2013 auditing should only be done by the experts. I first realised this when a security…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[5,12,13,16],"tags":[126,155,430,1254],"class_list":["post-3249","post","type-post","status-publish","format-standard","hentry","category-backup-theory","category-general-technology","category-general-thoughts","category-networker","tag-auditing","tag-backups","tag-health-check","tag-security"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t