Ahh, the big balancing act between usability and security. This same argument can be used for just about every single security measure you can think of. And it is. Sadly, very often.
This can be a valid argument, but "top guy" should have gone into more detail on why security can be lax in this case. At least you gave a couple reasons that any audit would ding the organization about as well. Or at least escalate so someone who can make a risk decision can do so. The next step might be to illustrate to "top guy" what could be disclosed should someone guess the password and poke around. Could it open up the app to more attacks once you get into the meat of the functionality? Could the app expose the server and then others? Or the database underneath that might be shared with other apps? Etc. On Mon, Oct 12, 2009 at 12:24 PM, Soft Reset <[email protected]>wrote: > Without spilling details, I told the IT team to remove an exposed web > portal from the internet as it was not SSL protected and the password was > easy enough to be found in my kid's "My First Dictionary". This is the > response I got back from our "top guy": > > "Many people need access to the web portal. Remember that one of the > objectives is to develop a strategy > for the customer. Easier access, not harder, should be the goal." > > I laughed. How about you? > > > --SR6 > > _______________________________________________ > Pauldotcom mailing list > [email protected] > http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom > Main Web Site: http://pauldotcom.com >
_______________________________________________ Pauldotcom mailing list [email protected] http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
