Defense is the use of security countermeasures to protect the integrity of the information assets in an IT system and/or infrastructure.

learn more… | top users | synonyms (2)

241
votes
3answers
55k views

CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
18
votes
4answers
7k views

Options when defending against SSLstrip?

I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?
24
votes
2answers
5k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
24
votes
5answers
106k views

What can a hacker do with an IP address?

I have an internet connection with a static IP address. Almost all staff in my office know this IP address. Should I take any extra care to protect myself from hackers?
59
votes
15answers
3k views

Why do law-abiding citizens need strong security?

The layman's counter-argument I run in to for any complaint about inadequate security seems to always take the form: You don't need security if you aren't doing something illegal. This kind of ...
24
votes
7answers
3k views

When do honest people need privacy or anonymity? (e.g. they have nothing to hide) [closed]

I'm having a discussion with someone who thinks they don't need technical measures of privacy or anonymity. Common arguments against needing to care about privacy or anonymity include: Everything ...
30
votes
6answers
4k views

How safe are employee laptops in China against International corporate espionage?

I recently took a business trip to China. Our IT department told me I could not take my normal machine, and instead gave me a loaner. This loaner had MS Outlook and was linked to my normal company ...
25
votes
3answers
3k views

NoScript: How to determine which sites/scripts to whitelist?

NoScript is a great plug-in, both for security and for ad blocking. However, I've found it's not always easy to figure out what scripts need to be permitted on certain pages, to be able to use the ...
3
votes
2answers
155 views

As a user, how can I defend myself from disclosed unpatched zero-day vulnerabilities?

In the wake of the Hacking Team breach on July 6th, 2015 [1] [2] I heard that some previously unknown zero-day exploits might surface (apparently one for Flash already has). Once these exploits ...
8
votes
2answers
2k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
2
votes
3answers
130 views

Security of decompression tools

How safe is it to decompress untrusted files with unrar-free? With unzip? I'm using debian jessie. What steps can be taken to minimize the threat while extracting the file's contents?
7
votes
2answers
3k views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
6
votes
3answers
3k views

What can a hacker do when he has physical access to a system?

I mean, I'm a tech guy here in my region (not a hacker...). When I sit in the front of another person's PC, I notice a little fear about what I can do in the system. It's obvious that I will not ...
7
votes
1answer
565 views

What are some good ways to secure personal computers

I see that many topics here are related to securing data, equipment at an enterprise level. Good advice includes stuff like blocking all unused ports, allowing only whitelisted traffic and installing ...
22
votes
8answers
4k views

Is possible to get infected by only staying connected to the Internet (nothing else)?

I have a router and I'm the only user. I have a computer with Linux and a tablet with Windows 8.1. Because of a few problems, I had to reinstall Windows on the tablet. Since I'm a bit paranoid about ...
7
votes
3answers
208 views

Server Infection: post-cleanup best practices

I've read through How do I deal with a compromised server? and have followed the steps to cleaning-up/mitigating any future damage. I'm just wondering if there are any post-clean up steps that are ...
3
votes
4answers
363 views

How effective are password checking websites? [duplicate]

I typed the following password in howsecureismypassword.net: yummy candy yummy It said it would take 100 billion years for a personal computer to crack. Is this accurate? Even though it has English ...
0
votes
2answers
7k views

Trying to get rid of hackers who have access to all my devices [closed]

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
3
votes
1answer
336 views

Can TLS Compression be enabled on 3rd party CDN sites that have no authentication?

In this answer, @Thomas Pornin talks about remediating the CRIME attack and says: (It is a shame to have to remove SSL compression, because it is very useful to lower bandwidth requirements, ...
1
vote
1answer
46 views

CSRF Prvention Token Mechanism: Back button Navigation

I have a legacy web application and need to prevent it from CSRF. I tried to resolve the issue without compromising application functionality and got issues related to navigation. The main concern ...