The tag has no usage guidance.

learn more… | top users | synonyms

9
votes
2answers
264 views

Is SWIFT (banking) Software Architecture Secure?

With all the news about hacking banks and stealing money from banks over SWIFT, while the vulnerabilities weren't directly related to SWIFT, some questions arise: Are software components of the ...
1
vote
1answer
74 views

Is there any architecture where the data storage is completely separate?

I want the hard disk where my data is stored to be secure from foreign external access. Is there a physical possibility to protect my hard disk or any kind of data storage, like a computer ...
0
votes
2answers
133 views

Separate web and app server windows authentication

I understand that separate web and app server can improve security. Your web server sits in a dmz and then there is firewall between it and the app server. We provide solutions to clients within an ...
2
votes
1answer
53 views

Counting on firewalls only : sound security strategy to prevent intrusion?

I had this discussion with a friend of mine who is a windows sysadmin. He said to me that for his company's IT security, he is doing only updates on the windows server. But except these system ...
6
votes
2answers
125 views

Is it good to store passwords in a separate table/database and manage them in a separate process?

I'm quite a newbie at systems architecture and security so I just want to check that this plan makes sense. I'm building a web app and I need to store a password for each user. I've already read ...
2
votes
2answers
147 views

Using separate HAProxy and API tiers, how can I ensure a request came from HAProxy?

I have two machines and a HAProxy machine doing SSL termination and accepting client certs successfully. How can I configure HAProxy to ensure that the messages coming into the API box are from ...
3
votes
3answers
373 views

Is web application connected to a database via an application server is more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
4
votes
3answers
1k views

Secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces. One is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
0
votes
2answers
82 views

Modular security for a photography UAV?

Is modular security possible? In the context of an embedded device, is it possible to create an add-in module that will be responsible for both communications and security, with his role being ...
2
votes
0answers
54 views

Is it necessary to have security documentations, policies, DRP & BCP's at place in order to execute secure network architectural review?

One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables ...
1
vote
0answers
25 views

Authenticating requests across a two tier application architecture

Consider the following architecture: Users log into a website and issue commands to the website. In parallel, separate software processes ("agents") on different computers connect to the website ...
10
votes
1answer
159 views

Are there any architectures currently out there that use hardware-enforced process isolation? What would it take to add that to x86?

First-time asker/commenter, long-time reader. As someone who's currently doing a lot of thinking & writing about measures that might foundationally improve computer security (ie., involving not ...
1
vote
0answers
78 views

Docker: Central daemon model is flawed?

I've read this article about CoreOS's new container runtime, rkt, and I'm curious about this section: Why not just fork Docker? From a security and composability perspective, the Docker ...
0
votes
2answers
35 views

Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?

I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that: https://github.com/awslabs/s2n#compartmentalized-random-number-generation The security of TLS and its associated ...
0
votes
2answers
113 views

encryption protection against lost password

Here is a plan I am thinking about. I haven't seen this proposed, so I thought I would ask about it. Threat we are guarding against: A lost or stolen laptop leading to exposure of sensitive ...
2
votes
0answers
81 views

If someone hacks our server, how can we prevent them from decrypting data stored in Vault?

I have been tasked with evaluating Vault in our company and the first question asked by an architect was: If someone hacks our server, how can we prevent them from decrypting data stored in Vault? ...
1
vote
3answers
199 views

Is this approach to backups secure?

I've got an existing (personal) backup service which I'm rewriting from the ground up to be secure. At present, I just store files (and diffs) in AWS S3 with no encryption. It works fine but I'd like ...
1
vote
1answer
395 views

Difference between Architecture review and a Design review

As the question says, I would like to know the difference(s) between an Architecture review and a Design review. If someone could explain the two using an example, such as an Architecture review of a ...
0
votes
4answers
102 views

post-disk-wipe computer security

I have a standard Dell or Asus-motherboard based computer. it is a hard-disk or RAM. it was hacked remotely. I suspect that they were sophisticated. I am happy to reformat the disk and/or throw it ...
5
votes
2answers
188 views

How should I document my Public Key Infrastructure?

I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert. I suppose the ...
0
votes
1answer
283 views

using temporary tokens for secure communication with IFRAME

I have questions about our application's security architecture: A critical piece that cannot save state but collects and displays sensitive information is served up in an IFRAME inside a more modern ...
0
votes
1answer
271 views

How to secure sensitive data in application with message queue

Currently we are creating one small service, where we are using some sensitive data from users(not worth zillions but to me it is like password). The idea is that application itself only inserts this ...
57
votes
9answers
7k views

How do you explain to experts that a database server should not reside in the DMZ?

Our security experts, database administrators, network team and infrastructure team are all saying it's OK to have the database server located in the DMZ along with the HTTP server and middle-ware ...
2
votes
1answer
154 views

Security of mainframes?

I am very intrigued as to how mainframes seem to be much more secure than the servers. Malware targeted are mainframes are very rare. It is due to security through obscurity? Since few people have ...
0
votes
2answers
2k views

What kind of attacks can happen on port 80

I am a novice to network security domain. For one of our clients, we are trying propose a network model where an Apache proxy/web-server which will be the only one that is exposed into the DMZ(...
2
votes
1answer
283 views

HIPAA compliant blob storage architecture

There is a task to design a system to store sensitive data securely (should be HIPAA compliant in the future). It's just a draft - this will not be used in production in a foreseeable future. I have a ...
0
votes
1answer
2k views

Dual Firewall DMZ

We've just learnt about firewalls and DMZ and I'm struggling to understand how are these actually implemented ? The architecture we've learned was something like this: Let's say that we have a ...
8
votes
4answers
865 views

Is there a book about secure system design? [closed]

I'm interested in learning about secure system design - the whole stack. Currently, I'm an expert .net/C# developer and I know about the differences between different hash functions, public/private ...
3
votes
1answer
407 views

Theory about split data in several isolated (different physical server) DBMS to gain in security?

Suppose the following scenario: 1- A web app (on WEBSERVER1) and its database (on DBMS1) having very sensible information deployed in the same physical server (lets said that for simplification). ...
4
votes
2answers
2k views

How does processor architecture affect password hashing speed?

Does hashing speed vary significantly using different architectures (x86 vs ARM)? Scenario I am investigating the possibility of using a cluster of Raspberry Pi for cracking passwords hashed with ...
0
votes
1answer
647 views

Application security architecture framework

I'm writing a security architecture for the application I'm working with. I'm struggling in finding a framework to follow for this task. I can find a lot of frameworks like TOGAF and SABSA that works ...
3
votes
1answer
128 views

Designing a secure information system

Could someone please provide me with some guidance for a system I am designing... A general overview of the system is that it is to store information on staff and "customers" - this information ...
8
votes
4answers
389 views

Alternatives to the “open PC” security model

Today, PCs (laptops, desktops, etc.) generally work under what I'll call the "open PC" security model. Users have full, system administrator/developer-level access to their own machine. Users can ...
1
vote
1answer
115 views

How to respond to a request for information on a system's architecture without compromising security?

Let's say that I am a Federal CIO and need to respond to a request for information on the architecture of a financial management system. I want to demonstrate that the system is capable of supporting ...
5
votes
1answer
4k views

WCF - Is this a good security Architecture?

I am building an information recording system (WCF based) for a business that is accessible by staff over the internet. This software will not be distributed and there will only be a handful of users ...
2
votes
1answer
385 views

What is the most “safest” architecture to run in QEMU? [closed]

Currently OpenBSD supports these architectures ( http://www.openbsd.org/plat.html ): alpha Digital Alpha-based systems amd64 AMD64-based systems armish ARM-based appliances (by Thecus, IO-DATA, ...
1
vote
1answer
615 views

Web application vs web service security

My question is about the difference between usual security expectations from a web application (intended to browser navigation) vs SOAP web service. For a web application, an acceptable solution for ...
7
votes
2answers
2k views

Do the new instruction sets found on Intel's Haswell Architecture make any difference in cryptographic operations?

Intel's Haswell architecture has support for several new Bit Manipulation Instructions. In Intel's own words, Bit manipulation instructions are useful for compressed database, hashing , large ...
10
votes
2answers
732 views

AMD64 overflows and null bytes

In the past, I have managed to overflow my own vulnerable programs, and those of others, but only ever in a 32bit environment. Every time I try even a simple stack smash on a 64bit machine, I run into ...
2
votes
3answers
553 views

programming language and security threats

I am working mostly on C/C++ based enterprise applications. Now few modules are migrating to Java. Also in parallel, there has been stress on ensuring that the application has highest benchmark with ...
5
votes
2answers
916 views

Encryption key storage

I recently inherited an in-house built key storage system. The company stores credit card data in two database servers which are AES encrypted. The keys reside in a separate system that is located in ...
3
votes
2answers
1k views

Dirty and clean interface on DMZ gateways

We have a webservice border gateway in DMZ which handles incoming and outgoing webservice requests in terms of authentication and security. We have two network interfaces in place, on is called '...
3
votes
2answers
1k views

Added security risks that come with 3-tier software architecture

Are there any added security risks that come with using a 3-tier architecture such as MVC in a software project? I got asked this today, and my gut reaction was "I don't see why there would be." ...