Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.
4
votes
1answer
101 views
In the Clark Wilson models, why can't the TPs be executed in parallel?
I am studying the Clark-Wilson model, I can't exactly understand why the TPs must be executed in serial, is there a way to execute them in parallel?
What would happen if I did execute them in ...
2
votes
3answers
118 views
Using MD5 for file integrity checks?
General
Always check the MD5 hashes of the .NET Framework assemblies to prevent the possibility of rootkits in the framework. Altered assemblies are possible and simple to produce. Checking ...
4
votes
1answer
76 views
Integrity check against package repository?
I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates.
From time to time I want to boot from a clean boot ...
5
votes
4answers
182 views
Safest way for multiple users post to a single social networking account
Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of ...
2
votes
3answers
77 views
How do I transfer the HMAC?
I have a file I'd like to encrypt with a symmetric key using AES-256 and then use an HMAC for integrity. So I don't "roll my own" scheme which I know is a big mistake, what are the standards for using ...
5
votes
1answer
68 views
Authentication by Signing or MAC?
I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
3
votes
2answers
126 views
Confidentiality and integrity for web session
When the client authenticates with our service, he is issued an opaque "token". This token includes the information, that identifies the client and some other information about the client ("payload"). ...
5
votes
2answers
668 views
What security standards and regulations are in place for bank ATM?
Are there any international or US mandated standards and regulations that apply to communications between automatic teller machines and bank's central office? Are banks or ATM operators subjected to ...
4
votes
2answers
204 views
How to correctly implement AES in a backup application
I am writing a back-up application which should have the feature of encrypting the back-up. It must encrypt file data, paths and filenames. The application is being written in C# (.NET). Target is ...
1
vote
1answer
71 views
Ciphertext for email vs Ciphertext for database
Let's say Bob wants to send a message to Alice. This communication requires to achieve confidentiality, integrity, proof of origin, non-repudiation. Therefore we can use this cipher-text:
ciphertext ...
0
votes
3answers
154 views
Why is it necessary to match the checksum of a download with another file provided by the same server? [duplicate]
Possible Duplicate:
Does hashing a file from an unsigned website give a false sense of security?
On many servers providing files for download, there is a file on which checksums are ...
2
votes
2answers
96 views
What's the point of using multiple checksum algorithm with “aide”?
In aide the author offers more than one hash algorithm to do the check-sum, why is that?
Aren't a single one, i.e sha512 enough for determining file changes? I believe these algorithms are all ...
1
vote
1answer
76 views
how to stop write downs
Consider a scenario with two security levels, Alice and Bob. Bob is Alice's boss. Bob must be able to read Alice's documents but not write anything to her documents.
I am using encryption keys to ...
0
votes
2answers
250 views
Access control matrix and integrity
Can access control matrix in addition to confidentiality provide the integrity of the objects to which access is being controlled?
2
votes
1answer
118 views
Password checking in the context of symmetric encryption
It is my understanding that block ciphers like AES don't have any built-in mechanisms to verify data integrity upon decryption, although some modes of operation might provide that.
I played around ...
0
votes
2answers
99 views
API - How can I make sure data sent by the user is only sent to my application?
I have an API and a web application where users can login through another system and then post text messages to my application, for example.
How can I assure that when this data is only posted to my ...
1
vote
5answers
218 views
How can I prevent forwarding a manipulated email?
How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
2
votes
2answers
396 views
How to make a simple file integrity checker
I've seen many PHP file checker on the net. Basically they computes the sha hash of a requested file. Your PC queries periodically the script and alerts you if the returned hash changes.
The problem ...
1
vote
3answers
270 views
Is SSL Tamper Detectable?
I know how SSL provides security against people reading your messages - by encryting the message with a SYMMETRIC KEY, which was exchanged during SSL Handshake with the help of ASYMMETRIC KEYS. But I ...
18
votes
4answers
1k views
Why aren't application downloads routinely done over HTTPS?
We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits:
Encryption: The data can't be read by a middle-man while in transit.
...
1
vote
2answers
338 views
Signed request vs HTTP digest auth for API authentication?
By signed request I mean something like this (simplified example):
Client creates a sig in his request:
$sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
4
votes
2answers
244 views
Detect changes in /boot when using full disk encryption
When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
2
votes
3answers
122 views
Find changes and modifications made to system by application or virus,
I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images.
...
4
votes
1answer
192 views
Does deliberately wrong information from a DNS server violate standards generally accepted good practices?
For certain host names my DNS gives me a wrong ip address (the ip address of a transparent proxy) for which inverse DNS look up does not give me back the host I originally looked up.
This is related ...
1
vote
2answers
341 views
What are the most common files to check with File integrity monitoring software?
I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server.
Is there a ...
2
votes
2answers
75 views
Domain and IP scoring
What kind of things would you check in a domain and IP scoring system? Which things are the most important?
If I have a web site or web service, I would like to figure out a score for my visitor. If ...
3
votes
3answers
212 views
Why are handheld tape recorders used?
Pardon me for doing the following as I know it is cringed upon (the tv reference) but:
Is there any good reason for the usage of 'tape' recorders? Ex. taping a conversation between criminals, this is ...
2
votes
5answers
145 views
Is DRM considered Confidentiality, Integrity, Availability, or some combination of the three?
I was discussing software trial time limit enforcement with a colleague and the idea of CIA came up. Do stricter enforcement techniques increase confidentiality at the expense of availability? (for ...
1
vote
4answers
202 views
Integrity monitoring for a LAMP server
So I'm setting up a small e-commerce app, and am thinking what happens if the server is compromised. We are selling software so potentially an intruder could generate themselves some free serial ...
2
votes
6answers
355 views
Is a self signed certificate sufficient to prove the integrity of my executable?
I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe.
I would like to know if this ...
12
votes
7answers
996 views
Tripwire - Is it security Theater?
Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes.
Let's say I have tripwire configured to run ...
5
votes
3answers
1k views
Bell-LaPadula imlementation example
I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example.
I understand how the model works, but I have difficulties implementing it in a programming language ...
2
votes
3answers
149 views
Remote Connection Tampering
My small high street laptop repair/service/maintenance shop has been up and running for about 3 years. It's doing quite well so I'm looking to expand into other areas of the PC market.
One area I ...
11
votes
6answers
2k views
Does SSL/TLS (https) hide the urls being accessed [duplicate]
Suppose I type this in my browser
https://www.mysite.com/getsecret?username=alice&password=mysecret
and an attacker is watching all traffic from me to my ISP.
What information is protected by ...
13
votes
1answer
505 views
Are there Linux rootkits circulating that directly modify the kernel (without modules)?
It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
5
votes
3answers
200 views
How safe are copies of Firefox that are on various Mozilla mirror sites?
If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added?
I don't see any mechanism for ...
12
votes
1answer
846 views
Something is changing my hosts file without asking
First: I can't find any information on this phenomenon, not anywhere on the net.
I don't know which application does it, but something in my Windows 7 Home Premium system (fully updated & legal) ...
3
votes
4answers
1k views
I had SSL certificate on my site but still it has been hacked…how to prevent this from happening?
I used SSL certificate on my site but still it has been hacked.
How do I prevent this from happening?
Do SSL certificate come with a waranty which would compensate me because my site was hacked?
4
votes
3answers
250 views
Preventing users from tampering with replay data [duplicate]
Possible Duplicate:
Protect application from being modified
This probably belongs here as much as it does belong in gamedev.stackexchange.com, but I suppose I might find better technical ...
8
votes
5answers
528 views
Protect application from being modified
I have a question about how to protect a program from modification if that program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but it can ...
5
votes
1answer
236 views
Oracle Internet Directory (OID) hardening
What are best practices, recommendations, required reading for securing/hardening an Oracle internet directory?
note: OID is compatible with LDAP version 3.
7
votes
3answers
720 views
What does a court need to successfully prosecute a hacker? Please cite previous cases if possible
Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that:
Integrity of the investigation is maintained
The ...
