Defense is the use of security countermeasures to protect the integrity of the information assets in an IT system and/or infrastructure.

learn more… | top users | synonyms (2)

0
votes
2answers
789 views

future of graphical password authentication [closed]

I'm a student currently pursuing my Engineering in Computers. I'm planning to put all my knowledge in and try to actually implement something related to security. To be more specific I'm more ...
82
votes
12answers
11k views

What is different about being targeted by a professional attacker?

It is often said that security tools such as firewalls, antivirus programs, etc. are only effective against random, untargeted attacks. If you are specifically targeted by an intentional, professional ...
2
votes
1answer
251 views

Using SSH Private keys in Production environment

I have a need to scp a bunch of files from a production box to my development environment. I am a developer and have limited read access to the production machines. Instead of entering password for ...
0
votes
1answer
111 views

What is the difference between XSS and Cross Site Flashing? [duplicate]

I want to know the basic differences between XSS and XSF
1
vote
2answers
123 views

Firewall Security vs Anti-Virus

Overview of my question I want to create a secure Window's system without the use of an Anti-Virus program. Whilst I know there are many on-demand and live-scanning anti-virus programs readily ...
0
votes
1answer
334 views

Keyboard “eavesdropping” just got way easier, thanks to electromagnetic emanations

Just found this article which basically suggests that electromagnetic emanations can be used to eavesdrop on what you're typing. http://www.engadget.com/2008/10/20/keyboard-eavesdropping-just-got-way-...
16
votes
7answers
7k views

My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed, based on the logging of my NAS, that my IP address is targeted by a hacker. I already took action by automaticly ban the IP address permanently after five unsuccesful login attemps. ...
0
votes
2answers
8k views

Trying to get rid of hackers who have access to all my devices [closed]

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
5
votes
2answers
326 views

How do I check if a script is safe to run?

I've been using NoScript for a couple of years now but I can't seem to figure out which scripts are safe to allow and most of the time I just temporarily allow all the scripts. Is there a way to check ...
6
votes
2answers
361 views

Where can I “hide” easter eggs for students learning about Linux security?

I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
-3
votes
2answers
1k views

Time it takes to crack a password on site like yahoo [closed]

I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is ...
1
vote
0answers
19 views

Transaction without 3DS in some online websites is Fraud prone? [duplicate]

I use my MasterCard credit card for online transactions which uses SecureCode for preventing online frauds even though hackers knows our credit card details. I have come across many sites which is ...
2
votes
3answers
160 views

Example of application that doesn't require “strong authentication”

Does anyone have any examples of real-life applications that doesn't require "strong authentication". I am looking specifically for blog posts or even scientific papers that argue that "strong ...
-6
votes
1answer
154 views

Is www.cheap-lingerine.com safe to use my credit card on? [closed]

I want to make sure my information is safe. This website is openly china-oriented but says to secure card information with Secure Sockets Layer technology (SSL) on those pages that involve sensitive ...
1
vote
2answers
94 views

secure flash update

The default method for updating flash is through Adobe's unsecured http portal, which seems to be a serious security concern, given the access that flash has on a user's machine. Can anyone recommend ...
0
votes
0answers
189 views

Asking for more information about AlienVault.com using Spiceworks, viability of “suspicious IP” alert

Website here: alienvault.com I've been trying out Spiceworks for about a week, seeing what use I get out of it. Today I log in and see an alert: "(my computer) has established a connection to ...
2
votes
1answer
291 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
3
votes
1answer
784 views

Do non-browser clients work around Gmail's 2-factor authentication?

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the ...
0
votes
2answers
711 views

How to post comments on websites without being traced back

Just trying to get some general sense about the security on internet now-a-days. There are so many websites I go and comment on different things. If some comments are political and they don't like, I ...
2
votes
1answer
584 views

How ATM Surveillance Camera works? [closed]

I would like to know how the ATM pin hole camera works.Whether the pin hole camera works only once the card is inserted in ATM or during the cash withdrawal or it works always?
20
votes
5answers
2k views

Should I let a user know they have entered an unknown username or email address?

On my website I have a password reset page that users can use if they have forgotten their password. On this page they can enter their username or their email address and hit "reset" which will send ...
0
votes
1answer
459 views

Preparation for Blue Team Competitions [closed]

I am a CS student, and am considering competing in the National Collegiate Cyber Defense Competition. Although I have a fair amount of experience in programming competitions (e.g. ACM at High School ...
0
votes
1answer
134 views

What should you do when you notice weird traffic?

I'm not at this point yet, thankfully, but being prepared means knowing the answer before the issue arises, so here goes... You're looking through your firewall / website logs... And you notice a ...
1
vote
0answers
146 views

Industry average for security as a percentage of product budget?

Lets assume the product is pure software or a blend of software and cheap commodity hardware. Is there any work showing what the average industry spending is on just the security aspects as a ...
-3
votes
2answers
166 views

How to respond to Cyber Bullying? [closed]

I am trying to learn about Cyber Bullying and I was thinking that if in future I get bullied, then what I can do? I have learned how to use Maltego, but if someone damages your reputation, then is ...
3
votes
2answers
98 views

Difference between secure design patterns and a generic coding guidline?

Is there a difference between secure design patterns and a generic coding guideline from which you can derive a technology specific coding guidline? Patterns like "authentication", "secure sessions" ...
-2
votes
2answers
543 views

Life in cybersecurity: How do I get there? [closed]

I am 17 years old and my ultimate job goal is a cyber security professional. I have been extensively studying TCP/IP, along with all other subjects in the CompTIA Network+ certification which I hope ...
1
vote
1answer
60 views

Is a government entity capable of establishing a secure virtual currency system? [closed]

After reading about BitCoins, I can't help but contemplate the idea of the a government withdrawing paper money and bringing all currency transactions digital, via a bitcoin-like method where every ...
0
votes
2answers
401 views

Programming languages for security? [duplicate]

I am a computer science student interested in the field of security and just had a few questions. What are the pros and cons for using C# for security purposes, I had assumed applications programmed ...
0
votes
1answer
104 views

Do software systems become more secure every year? [closed]

It seems to me that computer software is becoming more secure every year - there are fewer zero-day exploits to be found, many hacker-proof concepts are becoming widespread (such as virtualization and ...
1
vote
1answer
3k views

Nowadays, what is the difference between Cyber Security and IT Security? [closed]

Lately (and not so lately), you can hear a lot about cyber security. It is really hard to find an official description about this matter so, let's take the ISO 27032 description: "Cybersecurity” ...
0
votes
1answer
138 views

Which is considered the first Cyber Security incident? [closed]

No matter we are talking about Information Security, or cyber security or IT security... I always hear first about "the moth" being the first security threat. But I don't believe it is when talking ...
3
votes
1answer
144 views

Similar products to MS EMET [closed]

Following the weekend announcement from Microsoft regarding the vulnerability in IE I have been looking at additional security defences for our endpoints. I've read some technical documentation and ...
0
votes
1answer
94 views

A demonstration of the most basic form of a data breach or similar attack

I am currently working on my bachelor thesis regarding cloud security and found this neat article describing the "Notorious nine" written by the CSA: The notoruios nine I am looking to try out some ...
3
votes
3answers
253 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
7
votes
3answers
211 views

Server Infection: post-cleanup best practices

I've read through How do I deal with a compromised server? and have followed the steps to cleaning-up/mitigating any future damage. I'm just wondering if there are any post-clean up steps that are ...
1
vote
2answers
212 views

How to know what personal information companies know about myself

I've been learning about Cyber Security and how to protect myself online after reading some books on the subject and I want to know how much Information i've handed out to companies.
2
votes
1answer
65 views

Method/program for editing secure files

I'm not entirely sure if this is on-topic for Security.SE, but it doesn't seem entirely off-topic either, so I'll try. :) I keep a couple of (GPG-)encrypted files with more-or-less sensitive ...
-2
votes
1answer
2k views

A clear definition for procedural security controls? [closed]

Can you please provide a clear definition for procedural security controls? Are operational and procedural security controls synonyms? Thanks
2
votes
3answers
503 views

What is the current best practice to secure an executive's laptop?

What is the current best practice to secure an executive's laptop? The exec will be processing highly sensitive documents (high-value bids, merger & acquisition info, technical specs). As such ...
3
votes
3answers
616 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' --...
2
votes
1answer
481 views

Localhost WebSocket defense

If a malicious application has found its way onto a computer running a localhost only WebSocket server, would it help if the communications used SSL? If so, how could SSL fail if a malicious app ...
8
votes
2answers
4k views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
1
vote
1answer
108 views

Ideal cryptocurrency digital signature

What are the characteristics of the ideal digital signature for cryptocurrency transaction verification? The reason I ask is because this answer about bitcoin signatures describes a potential ...
1
vote
1answer
346 views

List of social engineering hacks and defenses [closed]

Sorry if this question is absolutely stupid or irrelevant, but I can't help but ask. I am just curious about different approaches hackers take in social engineering attacks, and clever examples of ...
-4
votes
2answers
761 views

Defend against HTTP fingerprinting [closed]

I'm looking for ways to defend against common fingerprinting techniques used by hackers to identify what kind of setup my website is running on. I understand this is a complicated topic, and every ...
1
vote
1answer
2k views

Why Qualys SSL Server Test is giving me 80 and not 100 in Key Exchange?

My openssl ciphers -v 'CIPHER' output is the following: ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=...
3
votes
2answers
316 views

Is it true, that using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret?

I am a newbie in the security field, so sorry for the naive question. In my understanding, using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can ...
8
votes
2answers
2k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
11
votes
4answers
2k views

How effective are anti-virus products against real-world threats?

In a recent interview† with Dave Kennedy, he in passing pegged the average effectiveness of anti-virus products as detecting approximately 3% to 5% of current active threats. While AV comparisons ...