Thread Info
  • Locked Locked
  • Replies 1 reply
  • Subscribers 2 subscribers
  • Views 2388 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Passwords Stored as SHA-1 in Unencrypted Backups

Kyle Parrish

Going through the configuration backup process for the Sophos Email Appliance and came across the following:

  • Only backup option is FTP
  • Does not require username and password
  • Backup files are not encrypted
  • Admin/Helpdesk passwords are stored in raw SHA-1

As a security company it would seem that this process would be a little more hardened...or at least follow the OWASP standards for protecting stored credentials...https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md

 

Has anyone else been concerned with this process?



This thread was automatically locked due to age.
Parents

  • Hello  

    You can download the backup to a local machine as well by clicking the Download button in the backup option. Regarding encrypted backup and password encrypted in SHA-1, I'll get that checked and see what are the developments in that direction.

    Regards

    Jaydeep

Reply

  • Hello  

    You can download the backup to a local machine as well by clicking the Download button in the backup option. Regarding encrypted backup and password encrypted in SHA-1, I'll get that checked and see what are the developments in that direction.

    Regards

    Jaydeep

Children
No Data
Unfiltered HTML