I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though. As society has crossed into ...
I've heard of FAIR, and that seems pretty great. What other methodologies are there? How do they work? What are their benefits, and their drawbacks compared to others? When is each appropriate? ...
How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
I'm looking for a fully open quantitative risk assessment methodology. Most of the methodologies have usage or licensing restrictions placed upon them. I define open as methodology covered by ...
How secure is the CentOS Linux distribution? I noticed there were times when there were no up-to-date patches for some version of CentOS (e.g., 5.6). I read this on some mailing list that I can't ...
Im trying to work out if the traffic in the below image is P2P file sharing? If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...