[mothered]

Like you provide them with an efficient solution to a pretty big problem one company has, and they don't even bother to look into it.

It can be a huge Issue for the company Itself, but the critical Information stored In the customer/user database Is a major cause for concern.

That's definitely another factor that affects not just the company, but the people who trust the company. This is quite sad, because companies have this responsability to protect users data, and they don't even bother to take action when somebody reports a security problem. Thus the user information end being leaked or sold and they might not even know it.

I can confidently say that over 80% don't check their log files.

Over 50% do not have a WAF, IDS/IPS nor data sanitization In place. Over 70% don't have account lockout policies, and 90%+ do not authenticate when performing edits In the back-end/server-side. Less than 5% use OTP and around 20% use additional forms of authentication at the client-side. 50-60% have timeout sessions Implemented.

The Insecurities speak for themselves.

[darkninja1980]

It can be a huge Issue for the company Itself, but the critical Information stored In the customer/user database Is a major cause for concern.

That's definitely another factor that affects not just the company, but the people who trust the company. This is quite sad, because companies have this responsability to protect users data, and they don't even bother to take action when somebody reports a security problem. Thus the user information end being leaked or sold and they might not even know it.

I can confidently say that over 80% don't check their log files.

Over 50% do not have a WAF, IDS/IPS nor data sanitization In place. Over 70% don't have account lockout policies, and 90%+ do not authenticate when performing edits In the back-end/server-side. Less than 5% use OTP and around 20% use additional forms of authentication at the client-side. 50-60% have timeout sessions Implemented.

The Insecurities speak for themselves.

very interesting. I do like having this conversation.

[mothered]

That's definitely another factor that affects not just the company, but the people who trust the company. This is quite sad, because companies have this responsability to protect users data, and they don't even bother to take action when somebody reports a security problem. Thus the user information end being leaked or sold and they might not even know it.

I can confidently say that over 80% don't check their log files.

Over 50% do not have a WAF, IDS/IPS nor data sanitization In place. Over 70% don't have account lockout policies, and 90%+ do not authenticate when performing edits In the back-end/server-side. Less than 5% use OTP and around 20% use additional forms of authentication at the client-side. 50-60% have timeout sessions Implemented.

The Insecurities speak for themselves.

very interesting. I do like having this conversation.

All the above Is based on personal experience with every type of organization- from Fortune 500 companies, to mediocre e-commerce sites.

What I've mentioned Is the very basics, that covers < 10% of Insecurities.

[darkninja1980]

I can confidently say that over 80% don't check their log files.

Over 50% do not have a WAF, IDS/IPS nor data sanitization In place. Over 70% don't have account lockout policies, and 90%+ do not authenticate when performing edits In the back-end/server-side. Less than 5% use OTP and around 20% use additional forms of authentication at the client-side. 50-60% have timeout sessions Implemented.

The Insecurities speak for themselves.

very interesting. I do like having this conversation.

All the above Is based on personal experience with every type of organization- from Fortune 500 companies, to mediocre e-commerce sites.

What I've mentioned Is the very basics, that covers < 10% of Insecurities.

understand your point.

[mothered]

very interesting. I do like having this conversation.

All the above Is based on personal experience with every type of organization- from Fortune 500 companies, to mediocre e-commerce sites.

What I've mentioned Is the very basics, that covers < 10% of Insecurities.

understand your point.

Time permitted, I'll document a very In depth thread of every major vulnerability, Insecurity and poor configuration that ultimately lead to exploitation.

[darkninja1980]

I will close this thread now.