Security theater is a term that describes security countermeasures intended to provide the feeling of improved security while doing little or nothing to actually improve security. The term was coined by computer security specialist and writer Bruce Schneier for his book Beyond Fear.
2
votes
4answers
114 views
Does Disabling Right Click In Windows Explorer Do Anything?
I am at a student at a school which blocks the right click in Windows Explorer and the desktop, as well as on the taskbar. I don't exactly understand why they do this, since most of the commands on ...
14
votes
4answers
442 views
What are the security threats of zip file uploads and what preventive actions should be taken?
We have a Drupal application developed for sharing files.
We are allowing zip files to be uploaded by logged in departmental user.
We are using Drupal private file system (outside webroot).
We are ...
15
votes
6answers
788 views
When secure email, is not really secure
We have a vendor who sends us "secure" messages. The messages come as an email message that contains a link to an SSL encrypted website that has the real message. There is no username/password on the ...
2
votes
3answers
219 views
programming language and security threats
I am working mostly on C/C++ based enterprise applications. Now few modules are migrating to Java. Also in parallel, there has been stress on ensuring that the application has highest benchmark with ...
-1
votes
1answer
104 views
How to prevent code injection like automatically adding extra character? [closed]
Code:
$result = "Hello World";
$jsonEncodeValue = $result;
echo $jsonEncodedValue;
Assumed Output:
"Hello World"
Real Output:
\n"Hello World"
This \n Line Feed added automatically.
For this ...
1
vote
1answer
78 views
What is the fight-back mechanism in OSPF?
I want to know more about the fight-back security mechanism in OSPF routing protocol.
When is the mechanism activated and how does it work?
I found the source description of OSPF fight-back, but the ...
7
votes
2answers
273 views
Are you aware of any CEO that went to jail because of Security Flaws?
I need to make a real motivation for a security talk to a board of management.
I know that in case a company ships products ignoring (so knowing and on purpose not caring) then it is held liable. What ...
0
votes
2answers
189 views
CMS security issues
I have a desire to make my own CMS , to improve my programming skills. I would use PHP as a server side programming language.
So my question is, on what security issues I must pay attention when ...
3
votes
3answers
90 views
Are mail-servers removed from security concerns in contrast with cloud storage?
I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
2
votes
1answer
200 views
cookie issue with same domain same path but different port
I have two web app running on same host on same path but on different port
http://somedomain.com/
and
https://somedomain.com/
now when I visit first app it serves the cookie say with name abc, and ...
2
votes
1answer
292 views
How to restrict SSH access outside of LAN? [closed]
We have several dedicated servers.
We need to ensure "root" user can not be accessible through SSH outside of LAN.
I have searched and found the followings #
...
2
votes
5answers
174 views
Is there any good (or less bad) way to handle a web portal or website with awful security?
Background:
I'm facing a situation with an online site I must (for the immediate time being) use for financial and HR-related matters that just sucks. In every sense, but security in particular. As ...
1
vote
0answers
29 views
What is the smallest possible Windows shellcode? [duplicate]
Possible Duplicate:
Are there any tools that focus on shellcode analysis?
Any tools available that is for shellcode analysis? what methods are used in reverse engineering?
2
votes
2answers
3k views
How does Remote Access Trojan / Backdoor Software work?
How does the RAT works? I understand it as once we surf the infected website, browser might download the trojan to our PC automatically. Will it executed and auto install in our computer?
I can't ...
13
votes
4answers
400 views
Effectiveness of Security Images
Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater?
Per my understanding, if somebody is phishing your users, it's ...
0
votes
1answer
115 views
How much does network security audit and patch work? [closed]
how much is reasonable if i'm looking to hire someone FULL TIME to handle security auditing and patching for my network? I need my network to be PCI Compliance and what not as well. MY office have ...
1
vote
1answer
165 views
Can I bypass my own networked camera?
We have networked camera on my house. My brother is protected by user name and password. When I check my network in laptop, I can see the networked camera in my network but when I click to open, it ...
1
vote
2answers
278 views
Is there any good open source software for Security Risk Analysis?
Is there any good open source software for Security Risk Analysis?
for example something like one explained on : http://www.security-risk-analysis.com/introduction.htm
12
votes
7answers
995 views
Tripwire - Is it security Theater?
Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes.
Let's say I have tripwire configured to run ...
13
votes
7answers
260 views
Is a “security measure” that doesn't provide a security benefit actually harmful?
If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful?
As an example, consider a login page where the user is asked to enter their ...
