Our security auditor is an idiot. How do I give him the information he wants?
1–10 of 50 posts
Re: Our security auditor is an idiot. How do I give him the information he wants?
#2Definitely seems less like a auditor (I believe asking for some of that is flat out illegal) and more like a hacker posing as a auditor, trying to get passwords/creditcard #'s.
Re: Our security auditor is an idiot. How do I give him the information he wants?
#3Definitely seems less like a auditor (I believe asking for some of that is flat out illegal) and more like a hacker posing as a auditor, trying to get passwords/creditcard #'s.
Bang on. Most likely social engineering. If this were actually an employee, they should be fired/told to fuck off.
Re: Our security auditor is an idiot. How do I give him the information he wants?
#4Perhaps the auditor is smarter than everyone thinks and is expecting the sysadmin to come to him empty handed and with an explanation as to why the requirements aren't reasonable.
Re: Our security auditor is an idiot. How do I give him the information he wants?
#5Perhaps the auditor is smarter than everyone thinks and is expecting the sysadmin to come to him empty handed and with an explanation as to why the requirements aren't reasonable.
He's already done that, and got the reply that every other company did it. The auditor is not just trying to get him to do the right thing.
Re: Our security auditor is an idiot. How do I give him the information he wants?
#6Perhaps the auditor is smarter than everyone thinks and is expecting the sysadmin to come to him empty handed and with an explanation as to why the requirements aren't reasonable.
The poster has already tried that, which is when the "auditor" replied with the "10 years experience" rant. If this actually is his tactic, then he should be fired simply on the principle that his modus operandi will cost the company clients, as it seems to be in this case. If he just has his head up his ass, then he needs to be fired for gross incompetence and the company may need to notify anyone that he's previously certified that they need to be recertified or at least notify them that there's a potential problem.
The "social engineering" idea is definitely worth considering, and the poster definitely needs to run this up the flag pole to his senior management. Preferably, this email would also have the words "contact our legal counsel" prominently displayed.
Re: Our security auditor is an idiot. How do I give him the information he wants?
#7Definitely seems less like a auditor (I believe asking for some of that is flat out illegal) and more like a hacker posing as a auditor, trying to get passwords/creditcard #'s.
Bang on. Most likely social engineering. If this were actually an employee, they should be fired/told to fuck off.
A social engineer wouldn't try for this much data. One SSH key or password would be enough. I'm going with the fucking-retarded-auditor theory.
Re: Our security auditor is an idiot. How do I give him the information he wants?
#8Am I the only one who thinks the story is a little too perfect and ridiculous? It is much more likely that the author simply fabricated the story.
He did manage to start a very popular thread, and get a ton of people with really high rep to respond AND get a link on HN. He just threw out some bait, and the community swarmed like starving fish.
Re: Our security auditor is an idiot. How do I give him the information he wants?
#9Earlier quoted context omitted.
Bang on. Most likely social engineering. If this were actually an employee, they should be fired/told to fuck off.
A social engineer wouldn't try for this much data. One SSH key or password would be enough. I'm going with the fucking-retarded-auditor theory.
Then again, it could be a social engineer trying to play off the commonly-held belief that an actual social engineer wouldn't ask for something so blatantly illegal.
Re: Our security auditor is an idiot. How do I give him the information he wants?
#10Earlier quoted context omitted.
A social engineer wouldn't try for this much data. One SSH key or password would be enough. I'm going with the fucking-retarded-auditor theory.
Then again, it could be a social engineer trying to play off the commonly-held belief that an actual social engineer wouldn't ask for something so blatantly illegal.
You think too much. Usually, the simplest explanation is also the correct one. I put my money on retarded auditor who thinks he's more clever and powerful than he is.