The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
2answers
27 views

Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?

I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that: https://github.com/awslabs/s2n#compartmentalized-random-number-generation The security of TLS and its associated ...
0
votes
2answers
49 views

encryption protection against lost password

Here is a plan I am thinking about. I haven't seen this proposed, so I thought I would ask about it. Threat we are guarding against: A lost or stolen laptop leading to exposure of sensitive ...
1
vote
0answers
60 views

If someone hacks our server, how can we prevent them from decrypting data stored in Vault?

I have been tasked with evaluating Vault in our company and the first question asked by an architect was: If someone hacks our server, how can we prevent them from decrypting data stored in Vault? ...
0
votes
2answers
56 views

Separate web and app server windows authentication

I understand that separate web and app server can improve security. Your web server sits in a dmz and then there is firewall between it and the app server. We provide solutions to clients within an ...
1
vote
3answers
165 views

Is this approach to backups secure?

I've got an existing (personal) backup service which I'm rewriting from the ground up to be secure. At present, I just store files (and diffs) in AWS S3 with no encryption. It works fine but I'd like ...
1
vote
1answer
83 views

Difference between Architecture review and a Design review

As the question says, I would like to know the difference(s) between an Architecture review and a Design review. If someone could explain the two using an example, such as an Architecture review of a ...
4
votes
2answers
108 views

How should I document my Public Key Infrastructure?

I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert. I suppose the ...
0
votes
1answer
102 views

using temporary tokens for secure communication with IFRAME

I have questions about our application's security architecture: A critical piece that cannot save state but collects and displays sensitive information is served up in an IFRAME inside a more modern ...
0
votes
1answer
129 views

How to secure sensitive data in application with message queue

Currently we are creating one small service, where we are using some sensitive data from users(not worth zillions but to me it is like password). The idea is that application itself only inserts this ...
53
votes
9answers
6k views

How do you explain to experts that a database server should not reside in the DMZ?

Our security experts, database administrators, network team and infrastructure team are all saying it's OK to have the database server located in the DMZ along with the HTTP server and middle-ware ...
1
vote
1answer
95 views

Security of mainframes?

I am very intrigued as to how mainframes seem to be much more secure than the servers. Malware targeted are mainframes are very rare. It is due to security through obscurity? Since few people have ...
0
votes
4answers
74 views

post-disk-wipe computer security

I have a standard Dell or Asus-motherboard based computer. it is a hard-disk or RAM. it was hacked remotely. I suspect that they were sophisticated. I am happy to reformat the disk and/or throw it ...
0
votes
2answers
945 views

What kind of attacks can happen on port 80

I am a novice to network security domain. For one of our clients, we are trying propose a network model where an Apache proxy/web-server which will be the only one that is exposed into the ...
2
votes
1answer
224 views

HIPAA compliant blob storage architecture

There is a task to design a system to store sensitive data securely (should be HIPAA compliant in the future). It's just a draft - this will not be used in production in a foreseeable future. I have a ...
0
votes
1answer
1k views

Dual Firewall DMZ

We've just learnt about firewalls and DMZ and I'm struggling to understand how are these actually implemented ? The architecture we've learned was something like this: Let's say that we have a ...
7
votes
4answers
721 views

Is there a book about secure system design? [closed]

I'm interested in learning about secure system design - the whole stack. Currently, I'm an expert .net/C# developer and I know about the differences between different hash functions, public/private ...
0
votes
1answer
421 views

Application security architecture framework

I'm writing a security architecture for the application I'm working with. I'm struggling in finding a framework to follow for this task. I can find a lot of frameworks like TOGAF and SABSA that works ...
3
votes
1answer
342 views

Theory about split data in several isolated (different physical server) DBMS to gain in security?

Suppose the following scenario: 1- A web app (on WEBSERVER1) and its database (on DBMS1) having very sensible information deployed in the same physical server (lets said that for simplification). ...
1
vote
1answer
110 views

How to respond to a request for information on a system's architecture without compromising security?

Let's say that I am a Federal CIO and need to respond to a request for information on the architecture of a financial management system. I want to demonstrate that the system is capable of supporting ...
5
votes
1answer
3k views

WCF - Is this a good security Architecture?

I am building an information recording system (WCF based) for a business that is accessible by staff over the internet. This software will not be distributed and there will only be a handful of users ...
2
votes
1answer
299 views

What is the most “safest” architecture to run in QEMU? [closed]

Currently OpenBSD supports these architectures ( http://www.openbsd.org/plat.html ): alpha Digital Alpha-based systems amd64 AMD64-based systems armish ARM-based appliances (by Thecus, IO-DATA, ...
8
votes
4answers
321 views

Alternatives to the “open PC” security model

Today, PCs (laptops, desktops, etc.) generally work under what I'll call the "open PC" security model. Users have full, system administrator/developer-level access to their own machine. Users can ...
1
vote
1answer
513 views

Web application vs web service security

My question is about the difference between usual security expectations from a web application (intended to browser navigation) vs SOAP web service. For a web application, an acceptable solution for ...
3
votes
1answer
119 views

Designing a secure information system

Could someone please provide me with some guidance for a system I am designing... A general overview of the system is that it is to store information on staff and "customers" - this information ...
7
votes
2answers
1k views

Do the new instruction sets found on Intel's Haswell Architecture make any difference in cryptographic operations?

Intel's Haswell architecture has support for several new Bit Manipulation Instructions. In Intel's own words, Bit manipulation instructions are useful for compressed database, hashing , large ...
2
votes
3answers
480 views

programming language and security threats

I am working mostly on C/C++ based enterprise applications. Now few modules are migrating to Java. Also in parallel, there has been stress on ensuring that the application has highest benchmark with ...
4
votes
2answers
1k views

How does processor architecture affect password hashing speed?

Does hashing speed vary significantly using different architectures (x86 vs ARM)? Scenario I am investigating the possibility of using a cluster of Raspberry Pi for cracking passwords hashed with ...
5
votes
2answers
760 views

Encryption key storage

I recently inherited an in-house built key storage system. The company stores credit card data in two database servers which are AES encrypted. The keys reside in a separate system that is located in ...
3
votes
2answers
737 views

Dirty and clean interface on DMZ gateways

We have a webservice border gateway in DMZ which handles incoming and outgoing webservice requests in terms of authentication and security. We have two network interfaces in place, on is called ...
3
votes
2answers
811 views

Added security risks that come with 3-tier software architecture

Are there any added security risks that come with using a 3-tier architecture such as MVC in a software project? I got asked this today, and my gut reaction was "I don't see why there would be." ...
10
votes
2answers
571 views

AMD64 overflows and null bytes

In the past, I have managed to overflow my own vulnerable programs, and those of others, but only ever in a 32bit environment. Every time I try even a simple stack smash on a 64bit machine, I run into ...