@J.J there was a client that required an onsite pentest (code review) but we didn't know how much it would take 3, 4 or 5 days? So we planned for 5, and if i finished earlier, i made a deal with the boss that i could use the rest of the days as "vacation"
Eh, we have some legacy software that is ringing all sorts of alarm bells on security scans due to insecure/weak ciphers. I don't know if disabling them would have any impact on the software/website running on the system.
@TomK. I agree. This is part of a legacy system from a company that we bought several years ago, and promptly fired the developers associated. Since then it has bounced around from owner to owner with no updating.
I am the latest owner, and I'm getting pinged for weak/insecure ciphers in TLS 1.0 and SSL 2.
Ah. I would guess in the matter of a couple hours I'd have calls.
When the security certs failed I had emails within an hour, and requests for updates from clients regularly until I could get them approved and installed.
@TomK. I get where you are going, but I don't think upgrading the OS is an option at this time. I can discuss that with my manager, but right now, I am about the only resource assigned to this and I (unfortunately) have the most knowledge about it. Which is to say, I've been assigned to this for about a month.
So if it goes sideways, we don't have a fallback currently.
sounds like pretty sensitive data, and this is what you should tell your manager. there is a machine that is doing sensitive things and it runs on an OS that is out of support for 3 years (?) now
We are setting priorities for the group this next couple weeks, I want to press this. My immediate concern is if disabling the security ciphers appearing on the vulnerability scan would break the application.
if you are not able to handle this situation with the limited technical knowledge about this service (which is totally fine) then you should hire someone or get a contractor who is able to
What I'm probably going to have to do is disable the ciphers on the server, and see if anyone on the outside screams at us. In which case, we'll have to play the "it's insecure. Update YOUR system" card.
@TomK. The guys doing firewall are crackers, I will run it by them. The entire group is really good, I'm a raw rookie on the sysadmin side. I was a dev/dev manager for 16 years, only recently converted.
My other headache is a windows server with an IIS installation whose sole purpose is to run two pages to point to a site on the same server running from a Tomcat install.
@JourneymanGeek Boy did they. Never had to reboot them. Just kept cooking. But that may have had something to do with the developer that created them. :p
@JourneymanGeek We didn't have limited resources, just a cost conscious company owner. Plus we had stability issues running Dialogic cards on a windows environment. Couldn't get the channel density per machine we needed.
Not that I'm bitter. But, at least I'm back in the tech world now. Sysadmin/Devops side, but it's interesting. Just a steep learning curve for a bit.
But, I hear from the one dev that they retained that they have fired the people responsible for axing our group, are shopping the division, and forcing out the VP over it.