Application security - Specific to securing an application rather than the connection, infrastructure, browser etc

learn more… | top users | synonyms (1)

1
vote
1answer
156 views

Examples of “Runtime application self-protection” (RASP) in action?

I'm having a hard time figuring out what "Runtime Application Self-Protection" (RASP) really is, though I see it mentioned in the press. The best description I've seen of the possible benefits, along ...
0
votes
1answer
186 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
0
votes
1answer
158 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered? Thanks!
2
votes
0answers
10 views

Freshness for SGX enclaves

Future Intel processors will support SGX (Software Guard Extensions), which allows running security-critical software on your processor in a way that is isolated from all the other code. The hardware ...
2
votes
0answers
275 views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
2
votes
0answers
70 views

Is it safe to remove these groups from the Local Security Policy area?

I'm trying to edit a particular section inside the Local Security Policy snap in and I'm wondering if I really need to give all of these groups (I think they're groups) permissions. Based on this ...
1
vote
0answers
35 views

Personally identifiable information in query parameter for Tomcat REST service

I have a REST API running in a Tomcat container that has an endpoint that takes a customer email address as a query parameter. It's something like this: /customers?email=foo@bar.com Customer email ...
1
vote
0answers
20 views

Resources and Examples for Modeling Application Security Groups

I am searching for some resources and documentation on modeling security groups for a web application, but seem to be coming up rather dry. I am interested in creating a visio-like diagram that ...
1
vote
0answers
111 views

Android app downgrading TLS protocol to SSL 3.0

I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes ...
1
vote
0answers
38 views

Adding intermediate page to navigate out of the current site

Can someone recommend me the best design to use to navigate out of the site. Here are the steps to navigate out of the current site. 1)Show the intermediate page warning the user that, they will be ...
1
vote
0answers
24 views

IdM on apps we host for a client

We're looking at hosting some of a client's existing applications in our environment. My current thinking is we will have an encrypted channel back to the client's network over which authentication ...
1
vote
0answers
28 views

Is there a repository of credentials used in training materials/samples and SDKs?

Similar to a default password list for network appliances, it's conceivable that application layer passwords are default from training materials given to a developer. In fact, I have discovered ...
1
vote
0answers
64 views

Is CVE-2011-1571 fixed in tomcat?

I dont see any record of CVE-2011-1571 being fixed in tomcat based on ASF' security reports for tomcat itself. Usually they specify the CVE number and information about the fix. This was 3 years ago ...
0
votes
0answers
49 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
0
votes
0answers
31 views

Should I add signatures to the Netscaler Application Firewall for Exchange, Cognos, etc?

This link describes that I can use Cenzic, IBM AppScan, Qualsys, Trend Micro and Whitehat files to create an application filter for various products. I'm looking for filters that apply to commonly ...
0
votes
0answers
40 views

Questions to confirm a good standpoint on web app security?

What should be the questions asked to assess a company on web app security? Our company is in process of partnering with another company in order to outsource web app security work to them. For us ...
0
votes
0answers
228 views

How can the .rsrc section of a PE used for evil?

I was doing some work with a bootable iso and ClamXav notified me that if found a potential security threat in one of the drivers, nvstor32.sys, located in the iso. I was really curious, so I googled ...
0
votes
0answers
80 views

Is it possible to prevent attackers from destroying sessions using cookie tossing and cookie overflow attacks?

I won't really go into details of how cookie tossing and cookie overflow attacks work, because this answer explains it perfectly. This post on github explains some mitigation strategies, but does not ...