81–90 of 114 posts
"At Sqreen, for example, if someone catches another person’s laptop unlocked while they’re AFK, they can type “Cookies!” in that person’s Slack. That person will then have to bring in cookies for the office!" This sounds like a fun idea, but has anyone ever refused to bring in cookies?
I'd be more inclined to do a "drinks" option.
They also have a good free site security eval: https://www.sqreen.com/scan It was after that I found out the only way to have HSTS for Cloudfront/S3 is creating your own Lambda@Edge function [1] :/ [1] https://aws.amazon.com/blogs/networking-and-content-delivery...
SAASPASS can do most of the items covered. 2FA Computer Protection with 2FA Enterprise Password Manager Single Sign On Directory Services
It also seems half-baked, to be frank, and really doesn't seem like it does "most of the items covered". The badly-written marketing all over your website immediately makes me think you're borderline scammers, too--I've got my beefs with Okta but they aren't trying to scare me about "man-in-the-mobile" attacks just because they use push notifications rather than SMS.
If you're serious about putting forward your product as a serious option in this space, can you tell us why we should trust you and how you're demonstrating that you deserve it?
Earlier quoted context omitted.
Quarterly audits are very much out of the norm among SAAS startups. Checklists that don't reflect reality don't help anybody --- but then, I guess I don't think this checklist does, either.
We use tools for automatic continuous assessment against a bunch of standards. They're not perfect but they help separate the signal from the noise immensely.
> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-... ) where they give the usual (at least 2 special characters, but not " or \) advice This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1]. [1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...
I’ve worked for companies where they ask for the out of date NIST stuff you mention and it’s either you follow what they ask or you lose out on a deal to fund your company.
They also have a good free site security eval: https://www.sqreen.com/scan It was after that I found out the only way to have HSTS for Cloudfront/S3 is creating your own Lambda@Edge function [1] :/ [1] https://aws.amazon.com/blogs/networking-and-content-delivery...
The correct entry URL appears to be https://www.sqreen.com/scanner .
Earlier quoted context omitted.
the assumption is you do not come up with your own words, and pick words at random from the whole dictionary.
I'm not sure I agree with that assumption, as the entire purpose of a passphrase of words rather than a password of random characters is that the passphrase should be easier to remember. If you're randomly picking words like 'gargarize-youster-noctivagant-axilla', it's not exactly accomplishing that purpose very well. It's also a huge PITA to type in, which based on my experience in the IAM space, is an immediate dea…
I really like this idea - alot. But aimed perhaps at everyone, not just the CTO. In fact the CTO probably needs one thing on their checklist. Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly". And if the company has the financial resources: Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist qua…
var sql = “select * from Users where firstname = ‘“ + firstname + “‘“;
var s3 = new S3Client(secret_key,access_key)