Defense is the use of security countermeasures to protect the integrity of the information assets in an IT system and/or infrastructure.

learn more… | top users | synonyms (2)

0
votes
1answer
106 views

What is the difference between XSS and Cross Site Flashing? [duplicate]

I want to know the basic differences between XSS and XSF
1
vote
2answers
121 views

Firewall Security vs Anti-Virus

Overview of my question I want to create a secure Window's system without the use of an Anti-Virus program. Whilst I know there are many on-demand and live-scanning anti-virus programs readily ...
0
votes
1answer
312 views

Keyboard “eavesdropping” just got way easier, thanks to electromagnetic emanations

Just found this article which basically suggests that electromagnetic emanations can be used to eavesdrop on what you're typing. ...
16
votes
7answers
6k views

My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed, based on the logging of my NAS, that my IP address is targeted by a hacker. I already took action by automaticly ban the IP address permanently after five unsuccesful login attemps. ...
0
votes
2answers
8k views

Trying to get rid of hackers who have access to all my devices [closed]

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
5
votes
2answers
306 views

How do I check if a script is safe to run?

I've been using NoScript for a couple of years now but I can't seem to figure out which scripts are safe to allow and most of the time I just temporarily allow all the scripts. Is there a way to check ...
6
votes
2answers
353 views

Where can I “hide” easter eggs for students learning about Linux security?

I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
-3
votes
2answers
1k views

Time it takes to crack a password on site like yahoo [closed]

I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is ...
1
vote
0answers
19 views

Transaction without 3DS in some online websites is Fraud prone? [duplicate]

I use my MasterCard credit card for online transactions which uses SecureCode for preventing online frauds even though hackers knows our credit card details. I have come across many sites which is ...
2
votes
3answers
155 views

Example of application that doesn't require “strong authentication”

Does anyone have any examples of real-life applications that doesn't require "strong authentication". I am looking specifically for blog posts or even scientific papers that argue that "strong ...
-6
votes
1answer
152 views

Is www.cheap-lingerine.com safe to use my credit card on? [closed]

I want to make sure my information is safe. This website is openly china-oriented but says to secure card information with Secure Sockets Layer technology (SSL) on those pages that involve sensitive ...
1
vote
2answers
93 views

secure flash update

The default method for updating flash is through Adobe's unsecured http portal, which seems to be a serious security concern, given the access that flash has on a user's machine. Can anyone recommend ...
0
votes
0answers
183 views

Asking for more information about AlienVault.com using Spiceworks, viability of “suspicious IP” alert

Website here: alienvault.com I've been trying out Spiceworks for about a week, seeing what use I get out of it. Today I log in and see an alert: "(my computer) has established a connection to ...
2
votes
1answer
278 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
3
votes
1answer
727 views

Do non-browser clients work around Gmail's 2-factor authentication?

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the ...
0
votes
2answers
668 views

How to post comments on websites without being traced back

Just trying to get some general sense about the security on internet now-a-days. There are so many websites I go and comment on different things. If some comments are political and they don't like, I ...
2
votes
1answer
543 views

How ATM Surveillance Camera works? [closed]

I would like to know how the ATM pin hole camera works.Whether the pin hole camera works only once the card is inserted in ATM or during the cash withdrawal or it works always?
20
votes
5answers
2k views

Should I let a user know they have entered an unknown username or email address?

On my website I have a password reset page that users can use if they have forgotten their password. On this page they can enter their username or their email address and hit "reset" which will send ...
0
votes
1answer
445 views

Preparation for Blue Team Competitions [closed]

I am a CS student, and am considering competing in the National Collegiate Cyber Defense Competition. Although I have a fair amount of experience in programming competitions (e.g. ACM at High School ...
0
votes
1answer
130 views

What should you do when you notice weird traffic?

I'm not at this point yet, thankfully, but being prepared means knowing the answer before the issue arises, so here goes... You're looking through your firewall / website logs... And you notice a ...
1
vote
0answers
141 views

Industry average for security as a percentage of product budget?

Lets assume the product is pure software or a blend of software and cheap commodity hardware. Is there any work showing what the average industry spending is on just the security aspects as a ...
-3
votes
2answers
163 views

How to respond to Cyber Bullying? [closed]

I am trying to learn about Cyber Bullying and I was thinking that if in future I get bullied, then what I can do? I have learned how to use Maltego, but if someone damages your reputation, then is ...
3
votes
2answers
98 views

Difference between secure design patterns and a generic coding guidline?

Is there a difference between secure design patterns and a generic coding guideline from which you can derive a technology specific coding guidline? Patterns like "authentication", "secure sessions" ...
-2
votes
2answers
511 views

Life in cybersecurity: How do I get there? [closed]

I am 17 years old and my ultimate job goal is a cyber security professional. I have been extensively studying TCP/IP, along with all other subjects in the CompTIA Network+ certification which I hope ...
1
vote
1answer
60 views

Is a government entity capable of establishing a secure virtual currency system? [closed]

After reading about BitCoins, I can't help but contemplate the idea of the a government withdrawing paper money and bringing all currency transactions digital, via a bitcoin-like method where every ...
0
votes
2answers
376 views

Programming languages for security? [duplicate]

I am a computer science student interested in the field of security and just had a few questions. What are the pros and cons for using C# for security purposes, I had assumed applications programmed ...
0
votes
1answer
104 views

Do software systems become more secure every year? [closed]

It seems to me that computer software is becoming more secure every year - there are fewer zero-day exploits to be found, many hacker-proof concepts are becoming widespread (such as virtualization and ...
1
vote
1answer
3k views

Nowadays, what is the difference between Cyber Security and IT Security? [closed]

Lately (and not so lately), you can hear a lot about cyber security. It is really hard to find an official description about this matter so, let's take the ISO 27032 description: "Cybersecurity” ...
0
votes
1answer
136 views

Which is considered the first Cyber Security incident? [closed]

No matter we are talking about Information Security, or cyber security or IT security... I always hear first about "the moth" being the first security threat. But I don't believe it is when talking ...
3
votes
1answer
138 views

Similar products to MS EMET [closed]

Following the weekend announcement from Microsoft regarding the vulnerability in IE I have been looking at additional security defences for our endpoints. I've read some technical documentation and ...
0
votes
1answer
93 views

A demonstration of the most basic form of a data breach or similar attack

I am currently working on my bachelor thesis regarding cloud security and found this neat article describing the "Notorious nine" written by the CSA: The notoruios nine I am looking to try out some ...
3
votes
3answers
248 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
7
votes
3answers
208 views

Server Infection: post-cleanup best practices

I've read through How do I deal with a compromised server? and have followed the steps to cleaning-up/mitigating any future damage. I'm just wondering if there are any post-clean up steps that are ...
1
vote
2answers
210 views

How to know what personal information companies know about myself

I've been learning about Cyber Security and how to protect myself online after reading some books on the subject and I want to know how much Information i've handed out to companies.
2
votes
1answer
65 views

Method/program for editing secure files

I'm not entirely sure if this is on-topic for Security.SE, but it doesn't seem entirely off-topic either, so I'll try. :) I keep a couple of (GPG-)encrypted files with more-or-less sensitive ...
-2
votes
1answer
2k views

A clear definition for procedural security controls? [closed]

Can you please provide a clear definition for procedural security controls? Are operational and procedural security controls synonyms? Thanks
2
votes
3answers
493 views

What is the current best practice to secure an executive's laptop?

What is the current best practice to secure an executive's laptop? The exec will be processing highly sensitive documents (high-value bids, merger & acquisition info, technical specs). As such ...
3
votes
3answers
566 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' ...
2
votes
1answer
466 views

Localhost WebSocket defense

If a malicious application has found its way onto a computer running a localhost only WebSocket server, would it help if the communications used SSL? If so, how could SSL fail if a malicious app ...
8
votes
2answers
3k views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
1
vote
1answer
105 views

Ideal cryptocurrency digital signature

What are the characteristics of the ideal digital signature for cryptocurrency transaction verification? The reason I ask is because this answer about bitcoin signatures describes a potential ...
1
vote
1answer
343 views

List of social engineering hacks and defenses [closed]

Sorry if this question is absolutely stupid or irrelevant, but I can't help but ask. I am just curious about different approaches hackers take in social engineering attacks, and clever examples of ...
-4
votes
2answers
733 views

Defend against HTTP fingerprinting [closed]

I'm looking for ways to defend against common fingerprinting techniques used by hackers to identify what kind of setup my website is running on. I understand this is a complicated topic, and every ...
1
vote
1answer
2k views

Why Qualys SSL Server Test is giving me 80 and not 100 in Key Exchange?

My openssl ciphers -v 'CIPHER' output is the following: ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA ...
3
votes
2answers
313 views

Is it true, that using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret?

I am a newbie in the security field, so sorry for the naive question. In my understanding, using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can ...
8
votes
2answers
2k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
11
votes
4answers
2k views

How effective are anti-virus products against real-world threats?

In a recent interview† with Dave Kennedy, he in passing pegged the average effectiveness of anti-virus products as detecting approximately 3% to 5% of current active threats. While AV comparisons ...
5
votes
4answers
5k views

Is it better to choose a single vendor or multiple vendors

A discussion came up at work recently and a debate ensued regarding choosing a vendor. Several people were of the opinion that it is smarter and easier to choose a single security vendor for all our ...
5
votes
1answer
206 views

CSRF protection - 'back pages'

OWASP suggests that when implementing CSRF protection any attempt to go 'Back' in the browser will cause issues as Interaction with this previous page will result in a CSRF false positive security ...
6
votes
2answers
3k views

When, exactly, should old password reset tokens be deleted?

I'm trying to figure out best practices for working with password reset tokens. Say a user initiates the password reset process and the are emailed the reset token and we store a hashed copy in the ...