Prevention is the best medicine.
4
votes
1answer
200 views
Do I have to harden IE if I'm only using FF?
Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox.
The user uses only FF for browsing, never IE.
I'm ...
22
votes
6answers
2k views
Keeping secrets from root on Linux
I am looking for ways to harden a linux system so that even when gaining full root access (through legit or non-legit means), some secrets remain inaccessible. But first a little background.
Many of ...
19
votes
6answers
2k views
Secure Linux Desktop
I'm looking for hints about secure linux desktops. Securing servers is no problem. Most recent Software Updates, run only the services required etc. But what about desktops? I'm thinking about details ...
0
votes
2answers
3k views
Replacing windows shell for everybody but the system administrator
[cross posted from superuser - I believe the question is also relevant here]
I'm trying to harden a windows 7 machine, including replacing the default login shell from explorer.exe to a custom ...
5
votes
1answer
236 views
Oracle Internet Directory (OID) hardening
What are best practices, recommendations, required reading for securing/hardening an Oracle internet directory?
note: OID is compatible with LDAP version 3.
6
votes
1answer
2k views
How to secure a ActiveMQ?
Does anybody have experience with securing/hardening ActiveMQ?
Check lists or guides would be welcome.
5
votes
2answers
2k views
Implications of Trace/Track Methods on Apache
When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I ...
3
votes
2answers
374 views
ICMP redirects and source routing in the wild?
Theoretically, ICMP redirect messages (IPv4 and IPv6) and source routing (IPv4) / routing headers (IPv6) are very dangerous. However, I'm curious as to if attacks using these features really work in ...
3
votes
3answers
246 views
Servers: Why a separate device for a firewall, aside from reduction in IP spoofing or increase in performance
Why should the firewall be outside the server, excepting these two items
Take the performance impact of noise off of the server.
Add a physical layer between devices so they can be on separate ...
4
votes
5answers
396 views
What are the likely threats to a public-facing DB instance?
Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash.
We've been running an instance of MySQL internally for years and it's worked OK, but I ...
5
votes
2answers
227 views
Advice for writing my first application security review
I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
42
votes
8answers
6k views
Hardening Linux Server
We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH.
To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
0
votes
5answers
441 views
What should one do when he/she wants to protect him/her home--computer--?
As you know, deleting a file by pressing shift-delete or by using the Trash doesn't mean that the file is unrecoverable. It's data persists on your computer.
In day to day life, adversaries use ...
10
votes
3answers
819 views
Recommendations for Changing the Default Shell For Service Accounts
It seems as if most Linux systems use either /sbin/nologin or /bin/false as the default shell for service accounts. Many hardening guides, such as CIS benchmarks, recommend changing the default shell ...
5
votes
1answer
1k views
How do I apply a security baseline to Windows 2008 R2?
I've setup a Windows 2008 R2 server with an Active Directory Domain Services role. I would like to apply the Specialized Security – Limited Functionality (SSLF) security baseline to it, but am unsure ...
2
votes
1answer
129 views
Whitelisting applications in Windows7
Windows 7 and Server 2008 R2 come with a security tool called Applocker. This allows admins to restrict applications to a specific white list which can be as granular as the individual application ...
0
votes
2answers
684 views
How do we protect our server from anonymous hacker? [duplicate]
Possible Duplicates:
Hardening Linux Server
How to best defend against Targeted Attacks?
I read this news: Anonymous hacker group hits Apple, publishes data
My question: How do we ...
4
votes
1answer
352 views
Security Risk of Disabling forceguest in non-AD Environment
Our application group is looking to deploy a product which requires that we disable forceguest in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. We are running on a Novell network (I know, I ...
2
votes
1answer
2k views
How to ensure that VirtualBox guests can't break out of the vm to get access to the host machine? [duplicate]
Possible Duplicate:
How secure are virtual machines really? False sense of security?
E.g. on Ubuntu/Fedora - if I have VirtualBox installed and I'm running guests in it, then how can I make ...
10
votes
4answers
437 views
What does defense in depth entail for a web app?
I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level ...
1
vote
1answer
170 views
Effectiveness of Belarc Advisor
I have seen some people recommend Belarc Advisor for Windows hardening, especially for servers. It's supposed to check for stuff such as installed hotfixes and CIS benchmarks (<-- which are great, ...
17
votes
2answers
2k views
MySQL Server Hardening
Following the hardening theme....
What are some best practices, recommendations, required reading for securing MySQL.
