The tag has no wiki summary.

learn more… | top users | synonyms

64
votes
13answers
12k views

Why do sites implement locking after 3 failed password attempts?

I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
21
votes
4answers
973 views

How do you manage security-related OCD (i.e. paranoia)?

I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though. As society has crossed into ...
10
votes
3answers
301 views

What risk analysis methodologies should I use?

I've heard of FAIR, and that seems pretty great. What other methodologies are there? How do they work? What are their benefits, and their drawbacks compared to others? When is each appropriate? ...
6
votes
1answer
501 views

Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?

First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
3
votes
3answers
658 views

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
8
votes
3answers
3k views

Is CentOS a good choice from a security perspective?

How secure is the CentOS Linux distribution? I noticed there were times when there were no up-to-date patches for some version of CentOS (e.g., 5.6). I read this on some mailing list that I can't ...
7
votes
2answers
697 views

Looking for an open risk assessment methodology

I'm looking for a fully open quantitative risk assessment methodology. Most of the methodologies have usage or licensing restrictions placed upon them. I define open as methodology covered by ...
2
votes
2answers
1k views

how to identify p2p on network

Im trying to work out if the traffic in the below image is P2P file sharing? If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...