Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or ...

learn more… | top users | synonyms

2
votes
1answer
95 views

Possible to redact information in the clipboard, or to auto-redact when it hits a webpage?

Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider ...
2
votes
4answers
945 views

Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID

Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID" I know that not good to have clear text password in scripts (there is no alternative at the moment). But question is the ...
2
votes
6answers
482 views

How do I prevent data from leaving my network?

I have a network of about 10 computers and I want to prevent sensitive data and source code leaks. To achieve that, I would like to block all file uploading / attaching. What are the options ...
2
votes
2answers
71 views

Information disclosure by identifiers

I'm doing a small research and I observed quite a lot of sites that reveal some private information in the ID-s that they assign. As an example I would like to point out e-commerce sites that issue ...
5
votes
2answers
530 views

HTTPS Sensitive Information and Caching

I have a website where I need to share a sensitive key with the user. Of course, I'm using HTTPS on the page. The key is put into the HTML server-side in ASP.NET. My concern is, if the user's computer ...
2
votes
1answer
4k views

How to block all access to Akami deploy servers and Apple push servers?

I no longer blindly trust the numerous connections that occur at night and during the day that always go to "content" and "push" servers like: a23-33-37-54.deploy.akamaitechnologies.com ...
2
votes
5answers
481 views

How to restrict flash drives in Local Area Network

It is prohibited to use USB drives at our office, due to security reasons. But some people still use them to steal information. It is now a great risk factor at our office. Now we need to ensure any ...
0
votes
1answer
150 views

How far beyond using Shred should I go when deleting files? [duplicate]

Possible Duplicate: How can I reliably erase all information on a hard drive? I'm looking to securely erase my files. Is shred the best option besides ditching the hardware? To what lengths ...
0
votes
1answer
427 views

Data Retention Laws for ISPs in North America

I was reading an article on TorrentFreak where Private Internet Access claims the United States "is one of the only countries without a mandatory data retention law." According to the linked article ...
2
votes
1answer
1k views

How to secure MySQL based web session data table?

I have the following MySQL session schema: CREATE TABLE `SessionData` ( `id` varchar(50) COLLATE utf8_unicode_ci NOT NULL, `data` text COLLATE utf8_unicode_ci, `date` datetime DEFAULT NULL, ...
2
votes
2answers
422 views

How to prevent private data being disclosed outside of Organization

I'm not looking to secure my internal network Our company keeps sensitive customer information. How can I prevent this information spreading outside of the company ? How do big companies prevent to ...
6
votes
3answers
1k views

How to destroy old credit card?

What is the best (in terms of security) way to destroy old (but still working) credit card?
2
votes
3answers
330 views

Where do organizations store their sensitive documents? How do they protect them?

Where do organizations store their sensitive documents? How do they protect them? What are the pros and cons for each method? (If there are multiple common ones) EDIT: I am more referring to ...
1
vote
1answer
77 views

Ways to make it more difficult for data to be lifted from a website?

Assume for a moment that I run a public-facing website that hosts pictures and names of people in a "billboard" fashion (i.e. you do not have to register to view the information) and that my site ...
1
vote
1answer
513 views

What encryption is possible for ReadyBoost?

ReadyBoost is a technology to assist getting Windows Vista or 7 to load faster on memory-constrained PC's. Since a USB stick can be easily removed, what security options are available for this ...
2
votes
2answers
377 views

Google Account Compromised - Possible Investigation?

This morning, I've not been able to login to my Google Account. Google says, my account has been compromised and I had to walk through account credentials recovery and verify (SMS to verify phone ...
4
votes
1answer
304 views

What constitutes a Virtual Private Database?

I recently came across this term "Virtual Private Database" and I'm wondering what criteria need to be satisfied to allow use of the term. I first saw the term in an HP/Fortify doc: A virtual ...
2
votes
2answers
693 views

Keeping valuable algorithms secret

Given a securities trading algorithm that is very effective and thereby very valuable, how do you keep it secret and protect it from theft or copying? What techniques or architecture is the best? The ...
1
vote
3answers
377 views

Monitoring and filtering of arbitrary outgoing data

I would like to be able to not just centrally monitor but also filter any organizational data moving out our edge routers, regardless of the sender application and regardless of the protocol/port used ...
8
votes
4answers
681 views

Source code security

We have about 20 developers working in a heterogeneous environment, mostly using company laptops or desktops. We run Windows 7 on desktops/laptops and a mixture of Linux distros (Ubuntu/CentOS). ...
6
votes
3answers
805 views

Have hardware trojans been seen in the wild?

Military and intelligence organizations have spent a lot of resources guarding against the possibility of hardware trojans, unauthorized modifications to hardware circuits that leak information or ...
1
vote
0answers
71 views

Is there a way to detect and extract steganographically hidden data from a picture? [duplicate]

Possible Duplicate: Detecting Steganography in images Is there a way to detect and extract hidden data from picture which altered by steganography? For example, If someone tried to spill ...
2
votes
1answer
158 views

Firewall Considerations with PGP Universal

The PGP Universal server is a fairly complex piece of work that provides several different services. When constructing firewall rules I am trying to determine what implications there are for opening ...
5
votes
1answer
217 views

What particular devices and processes are available to destroy hard drives, per DoD 5220.22-M?

DoD 5220.22-M specifies the following methods for destruction of hard drives with classified data: Disintegrate Incinerate Pulverize Shred Melt I've seen shredders of the type that might be used ...
51
votes
4answers
21k views

How do you destroy an old hard drive?

How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
3
votes
3answers
2k views

Is running an erase tool after an OS install sufficient to ensure no data from the old install is recoverable?

How secure do you consider this process? A drive has data from a previous OS installation. A new OS installation is made on the drive, and Heidi Eraser is run on free space. What are the chances ...
6
votes
2answers
359 views

With Google's new Privacy Policies going into effect soon, how can I better protect myself using their services?

From what I can tell, the gist of the new Privacy Policy from Google is that they're making a blanket policy to allow using your data between all their services, however they see fit. So now one ...
2
votes
4answers
2k views

If a hacker were to compromise a GMail database

Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database? I assume nothing, and in order for ...
23
votes
5answers
4k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
6
votes
3answers
3k views

Recover the prior contents of RAM from a turned-off PC?

I've heard that if your PC is turned off, then an attacker can recover the RAM from the last session. I find this hard to believe. How could it be done?
4
votes
2answers
183 views

In the case of the Gawker data breach, would strong passwords be ok?

In the Gawker data breach, was just the database stolen and that gave free access to all user data? Or did the hackers still need to read the MD5's of the usernames and passwords to gain access to the ...
30
votes
4answers
12k views

Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?

Lots of different programs, such as Darik's Boot and Nuke, let you write over a hard drive multiple times under the guise of it being more secure than just doing it once. Why?
7
votes
3answers
33 views

Active measures against lost or stolen PDAs in healthcare?

Many physicians, nurses, and technical staff like to carry PDAs to be kept abreast of patient conditions. Various companies want caretakers to view ECGs on their iPads. Due to the incredibly private ...
29
votes
8answers
11k views

Are powerline ethernet adapters inherently secure?

I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
9
votes
3answers
1k views

localStorage for apps over https. What expectations are there?

I run an online gradebook. To keep student data private, I transfer all data over https. Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
1
vote
2answers
381 views

Are there sensors/devices to be used for reading magnetic bits of hard disk

I would like to ask about the availability of any sensor or device that can be used to read magnetic bits inside hard disks? I tried to google that but I did not see any useful thing till now. I think ...
13
votes
5answers
442 views

What is the risk of giving USB drives as promotional items by a healthcare provider

There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010. Besides this, if a healthcare company ...
1
vote
0answers
246 views

What hardware tools are useful to detect cyber crimes? [closed]

As the title says, I would ask about some tools or sensors that are available to be used to detect cyber crimes, specially I am looking for sensors that can be used to read and recover data from ...
3
votes
2answers
216 views

Concerns of data being on the cloud

Would you prefer a private cloud for your data or a public one? Who takes care of financial liability in case of any breach? Do companies still keep the most critical within their data centers, ...
4
votes
5answers
348 views

What would you define as an “advanced” hacker attempt?

This subject might just barely be a programming topic. Though, in my point of view, it is of great concern to programmers because of our responsibility to develop secure code. Recently, there has ...
15
votes
5answers
4k views

Preventing information disclosure from browser back button/history?

I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario: The primary user logs off the application, but does not close the ...
14
votes
2answers
1k views

The Creation of Secure Software Development Environments

[Edit] I did complete an analysis and framework of concepts that were included into my thesis for extensions to existing frameworks. All of the information in this thread was useful. The direct ...
5
votes
2answers
249 views

What to do in response to a source code and/or database leak by a third party hosting provider?

My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak. On first appearances, the web host ...
11
votes
6answers
882 views

Best method of retiring hard drives

What are some typical ways you guys retire hard drives? We have a hard drive that won't mount anymore (makes clicking sounds when it tries to mount). The data on it isn't necessarily sensitive (no ...
4
votes
3answers
161 views

Is there a common name for a software defect that leads to unexpected transfer of secret over the wire?

Suppose in a C++ program I use a memory region for temporarily storing an encryption key and don't overwrite that region afterwards. Then my program wants to send a data packet over the network. Due ...
35
votes
8answers
7k views

How can I reliably erase all information on a hard drive?

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also. Methods for flash drives ...
6
votes
2answers
2k views

How bad is the leaking of Internal IP addresses through external DNS

If an external DNS server is leaking internal IP addresses are there any significant security threats associated with this information leakage? Apart from most the obvious - gaining an understanding ...
0
votes
2answers
386 views

How does WikiLeaks(Julian Assange) get the US Embassy cables? [closed]

How does this guy get these cables? Are those cables routed through a single node, where this guy got it? If so, How it is possible? I mean, how that single point came under the control of Julian ...
14
votes
2answers
3k views

Hiding user account names from unauthenticated RDP sessions

This is for a Windows 7 Ultimate system, which is not a member of a domain. When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
8
votes
1answer
288 views

What is a practical example of an action that violates the non-interference model?

I'm studying the non-interference model as part of CISSP prep and am having trouble thinking of a practical example where a violation would be involved (and the consequences of those violations). I ...