Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or ...
35
votes
5answers
5k views
How do you destroy an old hard drive?
How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
26
votes
7answers
5k views
Are powerline ethernet adapters inherently secure?
I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
18
votes
4answers
4k views
Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?
Lots of different programs, such as Darik's Boot and Nuke, let you write over a hard drive multiple times under the guise of it being more secure than just doing it once. Why?
18
votes
6answers
3k views
How can I reliably erase all information on a hard drive?
As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also.
Methods for flash drives ...
15
votes
4answers
866 views
What is the easiest way to search massive, leaked databases for persons and personal information?
This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be!
A while ago a very MASSIVE database was leaked that contained ...
14
votes
8answers
607 views
Should the requirement of admin privileges be extended?
Seeing this comic from xkcd.com made me thinking:
Is extending the requirement of admin privileges to things such as connecting to the internet, running the web browser, reading browser and other ...
13
votes
5answers
2k views
Preventing information disclosure from browser back button/history?
I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the ...
13
votes
3answers
871 views
How should one properly dispose of a printer or fax which is used for sensitive documents?
If you need to dispose of printers or fax machines that have handled sensitive documents, how should they be handled? Should you permit them to be donated or sold for reuse outside the organization?
...
13
votes
2answers
1k views
Hiding user account names from unauthenticated RDP sessions
This is for a Windows 7 Ultimate system, which is not a member of a domain.
When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
12
votes
5answers
328 views
What is the risk of giving USB drives as promotional items by a healthcare provider
There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010.
Besides this, if a healthcare company ...
12
votes
2answers
713 views
The Creation of Secure Software Development Environments
[Edit] I did complete an analysis and framework of concepts
that were included into my thesis for extensions to existing frameworks. All of the information in this thread was useful. The direct ...
11
votes
4answers
758 views
Is clipboard secure?
Can a browser get the data on my clipboard? Data could be for example my temporary password?
Any browser or operating system that allows this?
11
votes
5answers
2k views
Could mint.com be more secure, and if so, how?
After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit.
The site has a bunch of links explaining how they're so secure. I ...
10
votes
6answers
601 views
Best method of retiring hard drives
What are some typical ways you guys retire hard drives? We have a hard drive that won't mount anymore (makes clicking sounds when it tries to mount). The data on it isn't necessarily sensitive (no ...
10
votes
4answers
1k views
Is it feasible to encrypt customers personal data? (name, address etc…)
Seeing the Sony Personal data kerfuffle unfold has gotten me thinking about the encryption and securing of personal data - obviously credit cards can (and should) be encrypted, making data breaches of ...
9
votes
4answers
534 views
Source code security
We have about 20 developers working in a heterogeneous environment, mostly using company laptops or desktops. We run Windows 7 on desktops/laptops and a mixture of Linux distros (Ubuntu/CentOS).
...
9
votes
3answers
744 views
localStorage for apps over https. What expectations are there?
I run an online gradebook. To keep student data private, I transfer all data over https.
Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
8
votes
5answers
248 views
How would you detect whether customer data has been leaked?
I'm a very security conscious (bordering paranoia) freelance web developer and I place a lot of emphasis on security with my clients, alas I've found this doesn't seem to be the case for the average ...
8
votes
1answer
152 views
What is a practical example of an action that violates the non-interference model?
I'm studying the non-interference model as part of CISSP prep and am having trouble thinking of a practical example where a violation would be involved (and the consequences of those violations).
I ...
8
votes
1answer
316 views
How can I secure my log files?
I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
8
votes
2answers
321 views
Is Data Remanence a Myth? [duplicate]
Possible Duplicate:
Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?
Multiple overwrites have often been discussed as a secure way of ...
7
votes
5answers
317 views
Swap file may contain sensitive data
Is it possible that the swap file will contain chunks of data by a file you have accessed, and could this be detected during a forensics analysis?
How could you prevent this situation ?
Is using ...
7
votes
3answers
430 views
What factors do you use to choose data loss prevention techniques to use, if any?
Had an excellent discussion this evening with ISACA Scotland around data loss prevention. There are technical tools out there from such luminaries as Checkpoint, MacAfee, Cisco, Symantec etc, but all ...
6
votes
3answers
25 views
Active measures against lost or stolen PDAs in healthcare?
Many physicians, nurses, and technical staff like to carry PDAs to be kept abreast of patient conditions. Various companies want caretakers to view ECGs on their iPads.
Due to the incredibly private ...
6
votes
3answers
384 views
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)
LivingSocial - 50 Million Users Exposed
Zappos - 24 Million ...
6
votes
3answers
567 views
Have hardware trojans been seen in the wild?
Military and intelligence organizations have spent a lot of resources guarding against the possibility of hardware trojans, unauthorized modifications to hardware circuits that leak information or ...
6
votes
2answers
299 views
With Google's new Privacy Policies going into effect soon, how can I better protect myself using their services?
From what I can tell, the gist of the new Privacy Policy from Google is that they're making a blanket policy to allow using your data between all their services, however they see fit. So now one ...
6
votes
1answer
290 views
Encrypting sensitive data in software and storing/decrypting it on a server
I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing.
I'm developing software which has 2 parts - a C# program run ...
5
votes
5answers
266 views
Effect of Source Code Leakage of a security suite on security
I am interested to know what threats does it pose, if the source code of a security suite is leaked. It came to my mind after reading the following URLs:
...
5
votes
3answers
402 views
How to destroy old credit card?
What is the best (in terms of security) way to destroy old (but still working) credit card?
5
votes
3answers
1k views
Recover the prior contents of RAM from a turned-off PC?
I've heard that if your PC is turned off, then an attacker can recover the RAM from the last session. I find this hard to believe. How could it be done?
5
votes
2answers
968 views
How bad is the leaking of Internal IP addresses through external DNS
If an external DNS server is leaking internal IP addresses are there any significant security threats associated with this information leakage?
Apart from most the obvious - gaining an understanding ...
4
votes
5answers
283 views
What would you define as an “advanced” hacker attempt?
This subject might just barely be a programming topic. Though, in my point of view, it is of great concern to programmers because of our responsibility to develop secure code.
Recently, there has ...
4
votes
3answers
153 views
Is there a common name for a software defect that leads to unexpected transfer of secret over the wire?
Suppose in a C++ program I use a memory region for temporarily storing an encryption key and don't overwrite that region afterwards. Then my program wants to send a data packet over the network.
Due ...
4
votes
2answers
164 views
What to do in response to a source code and/or database leak by a third party hosting provider?
My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak.
On first appearances, the web host ...
4
votes
4answers
373 views
What do you do to protect data on a Macbook in the event of theft/loss of the device?
What setup do you recommend to protect data on a MacBook in the event of theft/loss of the device?
I'm specifically interested in Macs here, rather than laptops generally, and in concrete ...
4
votes
2answers
169 views
In the case of the Gawker data breach, would strong passwords be ok?
In the Gawker data breach, was just the database stolen and that gave free access to all user data? Or did the hackers still need to read the MD5's of the usernames and passwords to gain access to the ...
4
votes
1answer
160 views
What particular devices and processes are available to destroy hard drives, per DoD 5220.22-M?
DoD 5220.22-M specifies the following methods for destruction of hard drives with classified data:
Disintegrate
Incinerate
Pulverize
Shred
Melt
I've seen shredders of the type that might be used ...
4
votes
1answer
398 views
Data loss protection in software artifacts
Data loss protection is a major concern to every industry. The software engineering process involves multiple points for potential data loss, as a number of parties are involved other than the client ...
4
votes
2answers
384 views
How to secure usb data storage of Android phones?
I just found out that if I connect my phone to a laptop with a cable, the password becomes completely USELESS. So how can I protect the data in my phone from a usb cable?
It's actually very easy to ...
3
votes
4answers
376 views
Is it ok to cut some digits from the front-face of a credit/debit card?
I'm a European expat living in Asia. I usually hide my credit card at my apartment. However, I'm a bit scared about losing it when I carry it (wallet robbed or lost).
That's why I already scrubbed ...
3
votes
3answers
1k views
Is running an erase tool after an OS install sufficient to ensure no data from the old install is recoverable?
How secure do you consider this process?
A drive has data from a previous OS installation.
A new OS installation is made on the drive, and Heidi Eraser is run on free space.
What are the chances ...
3
votes
2answers
184 views
Concerns of data being on the cloud
Would you prefer a private cloud for your data or a public one?
Who takes care of financial liability in case of any breach?
Do companies still keep the most critical within their data centers, ...
3
votes
1answer
69 views
Possible to redact information in the clipboard, or to auto-redact when it hits a webpage?
Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider ...
3
votes
1answer
219 views
What constitutes a Virtual Private Database?
I recently came across this term "Virtual Private Database" and I'm wondering what criteria need to be satisfied to allow use of the term.
I first saw the term in an HP/Fortify doc:
A virtual ...
2
votes
6answers
235 views
How do I prevent data from leaving my network?
I have a network of about 10 computers and I want to prevent sensitive data and source code leaks. To achieve that, I would like to block all file uploading / attaching.
What are the options ...
2
votes
4answers
220 views
How to restrict flash drives in Local Area Network
It is prohibited to use USB drives at our office, due to security reasons. But some people still use them to steal information. It is now a great risk factor at our office.
Now we need to ensure any ...
2
votes
4answers
1k views
If a hacker were to compromise a GMail database
Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database?
I assume nothing, and in order for ...
2
votes
2answers
253 views
Are there sensors/devices to be used for reading magnetic bits of hard disk
I would like to ask about the availability of any sensor or device that can be used to read magnetic bits inside hard disks? I tried to google that but I did not see any useful thing till now. I think ...
2
votes
2answers
193 views
HTTPS Sensitive Information and Caching
I have a website where I need to share a sensitive key with the user. Of course, I'm using HTTPS on the page. The key is put into the HTML server-side in ASP.NET. My concern is, if the user's computer ...
