I'm wondering if anyone has previously proposed, evaluated, or deployed the following measure to harden systems against heap-based buffer overruns: basically, stack canaries, but applied before ...
Consider the problem of hardening an existing, database-backed web application, to detect attacks and stop them where possible. It seems like one plausible approach might be to build an intrusion ...
Most Linux distributions now use ASLR for many programs, to randomize the layout of memory. How often is the randomness used for this changed? If I re-run the same program multiple times, will it ...
At IEEE Security & Privacy, the blind return-oriented programming attack (blind ROP) was just introduced. In some sense, this is just another variation on ROP attacks -- but the blind ROP attack ...
Intel has recently added new instructions to their instruction set to support bounds checking. Intel calls them the Memory Protection Extensions (MPX), and they are described in Chapter 9 of this ...
I need to develop an application security strategy for a web application product. Do you have any recommendations as far as procedures and policies are concerned? Any inputs / guidelines or relevant ...
Is there a checklist for securing MacOSX machines?
I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level ...