JFL Our security auditor is an idiot. How do I give him the information he wants? (Server Fault, 2009)

[Tarquinius]

https://serverfault.com/questions/2...ot-how-do-i-give-him-the-information-he-wants

As explained, this information should be easily available on any well maintained system to any competent administrator. Your failure to be able to provide this information leads me to believe you are aware of security flaws in your system and are not prepared to reveal them. Our requests line up with the PCI guidelines and both can be met. Strong cryptography only means the passwords must be encrypted while the user is inputting them but then they should be moved to a recoverable format for later use.

SOC auditors:

A profession where you're paid 6 figures a year to send emails asking about excel row items someone else more competent generated for you, and when asked for details or additional clarifications on their demands, just re-reads the excel row item verbatim and providing nothing of additional value.

 

[Tarquinius]

Must be a jeet

 

[incelerated]