For some background, I got an email from someone that used the contact form on my blog. They work for or with or own or something to do with a certain company that makes some products to supposedly secure email. It's really a hosted service they offer, with an option for larger companies to bring the system in house.
So the idea is, I'd like to interview them and grill them with some good questions about their products
If anyone is interested, it's not highly participatory so no worries about time or anything. Just send me any questions that you'd like them to answer. I'll take their answers and distribute them to interested people so that a second round of questions can be asked for further clarity.
@WesleyDavid As a service provider, they should have a SAS70 by now, and should be getting a SOC-2 or SOC-3 this year. Those will state the controls they follow and an auditor's review that they are (or aren't) followed.
@JeffFerland They came across me. They went to my blog's contact form and emailed me through that. They wanted to do a guest blog post on their products or do an interview.
I said I'd interview them but warned them that I'd be getting some hardass questions from infosec pros.
@WesleyDavid It's hard to figure out what they really do besides use SSL(I presume) for client connections and make sure that your data stays separate from somebody else's
@ScottPack I mean yes, they're right... if you're going to be discussing corporate mergers or other sensitive internal information, that does help prevent leaks...
@WesleyDavid Well, the issue is "abuse of exceptional trust"... and that is a real issue. I might have been hard on them by posting that.
My thoughts? I'm concerned they don't have revenue. They don't clearly state what they're doing to protect your privacy ("highest levels of encryption" -- big whoop). I want to know the actual technology and the control environment. I want to know how they recovery lost credentials.
@WesleyDavid "The Company anticipates that Rhino Marketing will assist the Company with the establishment of a global marketing campaign which will include social networking, public appearances and speaking engagements, guest appearances on television and radio, community outreach programs such as speaking at schools about online privacy and security, strategic media buys, and podcasts."
Speaking at schools? I can see the draw. Right in between gym class and social studies. "Hey kids! Let's talk about encryption, keypairs, TEH CLOUDS and you!"
Monitor the event logs on the domain controllers for event 672. It will show all successful logon events for AD users and which computer they logged on from. Filter by computer to get logon events for only those computers that you are interested in.
So that was a fun exercise in due diligence. To be honest, I wouldn't blog about their product... I have little confidence it will exist next year.... but I might blog about this exercise.
@JeffFerland Thanks for the sleuthing! My plan was to organize the questions and then cite my contributors. Do you want your name mentioned in the footnote? You won't be tied to specific questions. Unless that's what you want.
The Company does not currently have any full-time employees. Kasia Zukowska has been contracted by the Company to perform administrative duties on behalf of the Company. Gabriel Rosu has been contracted by the Company to perform software development duties and serve as the Chief Technology Officer for the Company. Brad Lever currently serves as the President, Chief Executive Officer, and Chief Financial Officer, and director of the Company without wages or salaries.
For the period ending June 30, 2011: Uncertainty as a Going Concern The accompanying financial statements have been prepared assuming that the Company will continue as a going concern. However, the Company has suffered recurring losses from operations since inception which raises substantial doubt about its ability to continue as a going concern.
During the three months ended June 30, 2011, the Company had revenues of $200 as compared to revenues of $434 during the three months ended June 30, 2010
During the three months ended June 30, 2011, the Company had operating expenses of $156,938 as compared to operating expenses of $352,602 during the three months ended June 30, 2010
OK, now I think he's unethical. I don't actually see anything linking that to Fox.
I run a tight ship at eCrypt. One of my more famous quotables is that “I know how to squeeze six cents out of a nickel” and that philosophy has allowed me to run our company successfully on very modest funding.
@WesleyDavid After everything I've just written here, would you?
Monitor the event logs on the domain controllers for event 672. It will show all successful logon events for AD users and which computer they logged on from. Filter by computer to get logon events for only those computers that you are interested in.
