Security theater is a term that describes security countermeasures intended to provide the feeling of improved security while doing little or nothing to actually improve security. The term was coined by computer security specialist and writer Bruce Schneier for his book Beyond Fear.

learn more… | top users | synonyms (1)

0
votes
0answers
46 views

How can a website charge my credit card when I entered an incorrect CVV? [duplicate]

I just created a free account on Pluralsight.com and entered my credit card details, but I entered my CVV incorrectly. How can they charge a payment to my credit card even though I entered an ...
4
votes
1answer
607 views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is ...
0
votes
0answers
40 views

Key Distribution using multicast

I am trying to come up with a solution for a system where i need to generate a key (Kn) from time to time and distribute it to a large number of servers in a private network. Since it has to be a ...
1
vote
2answers
89 views

Does having a separate e-mail account only for security, increase security?

In this article about increasing the security of LastPass the author suggests: For additional security, you can have LastPass send security-related emails to a special security email address ...
0
votes
4answers
107 views

Someone knows about online labs? [closed]

I'm looking for an online training lab for pentesting/hacking and security. I've found one at hacking-lab but it's seems troublesome to work with and it has some issues on VPN server authentication. ...
0
votes
4answers
119 views

How to secure my website's FTP?

When I opened ftp command prompt and typed open mydomain.com, it gave me the following and I think that this is a security vulnerable. connected to mydomain.com. 220----- Welcome to Pure-FTPd ...
0
votes
1answer
194 views

Are cross site scripting attacks and sql injection a good topic for my thesis? [closed]

So I'm doing my undergraduate thesis, I would like to explore how cross site scripting sql injections occur. And for the purpose of the thesis I'd also like to create a fictional website that is ...
2
votes
2answers
94 views

How much security information to publicise?

Apologies if this in the wrong section, not sure if it should go in Server Fault or not. I am preparing to launch a new web app. We have put a lot of effort into offering good security. From a PR ...
-1
votes
1answer
166 views

Can we identify if someone is keeping an eye on our computer usage?

For some reason I had been using public network for a small time, and I suspect that someone was actually watching/recording my online/offline activities. At some time I suspected that someone was ...
14
votes
7answers
2k views

Why don't banks get hacked?

From reading a lot of info on this website I came to the conclusion that if someone with enough skill really badly wants to gain access somewhere, then there is absolutely nothing stopping them from ...
1
vote
2answers
194 views

In what sense is Knock to Unlock safer than a password?

I've recently seen a youtube video, which is advertising an iphone app which will unlock your mac computer by knocking on your iphone. The ad is claiming that it is faster and safer than typing your ...
0
votes
1answer
68 views

Security principle regarding softwares

Security through obscurity isn't real security. That's why theoretically, closed source software is a wrong solution. A software, example an operating system still needs to be secure when ...
0
votes
2answers
421 views

Will an IP camera still work if the wifi router breaks or is turned off? [closed]

Im using and IP Camera at home and I have the footage being sent to an online file storage service as well as my handheld device through the internet. If the wifi router at home is turned off or ...
18
votes
6answers
7k views

Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This ...
38
votes
7answers
2k views

Popular Security “Cargo Cults”

In Information and IT Security there is a nasty tendency for specific "best practices" to become inviolable golden rules, which then leads to people recommending that they are applied regardless of ...
-3
votes
1answer
2k views

Google Chrome is keylogger? [closed]

Hi i am a little bit worried that Google Chrome is logging my keystroke. One time ago i had situation with chrome that when i clicked some where in input box he was writting key by key(even backspace) ...
29
votes
3answers
2k views

Changing picture as characters entered into password

When Lotus Notes asks for the password, it displays a screen with a picture that appears to change after a new character is entered after the fifth character. I have noticed the sequence of ...
-1
votes
2answers
130 views

ISMS for SMB (Small And Medium Enterprise)? [closed]

Is there an Information Security Management System (ISMS) existing for SME/ SMB, if not why ? The so called GRC suites are mainly targeted towards Fortune 100 (may be up to fortune 1000) companies , ...
1
vote
1answer
107 views

Notification or report for security problem of unix systems? [duplicate]

I have unix systems(Solaris,Oracle,Redhat vs).I have to control all system for security problem,bugs,patch,vulnerabilities I'm looking for securty information for all security issue After that I'll ...
3
votes
2answers
2k views

Checking SSL\TLS servers for null encryption support

I have a web server supporting SSL 3 and TLS protocols , the following are the supported cipher suites. TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can i ...
2
votes
4answers
430 views

Does Disabling Right Click In Windows Explorer Do Anything?

I am at a student at a school which blocks the right click in Windows Explorer and the desktop, as well as on the taskbar. I don't exactly understand why they do this, since most of the commands on ...
15
votes
4answers
1k views

What are the security threats of zip file uploads and what preventive actions should be taken?

We have a Drupal application developed for sharing files. We are allowing zip files to be uploaded by logged in departmental user. We are using Drupal private file system (outside webroot). We are ...
15
votes
6answers
897 views

When secure email, is not really secure

We have a vendor who sends us "secure" messages. The messages come as an email message that contains a link to an SSL encrypted website that has the real message. There is no username/password on the ...
2
votes
3answers
366 views

programming language and security threats

I am working mostly on C/C++ based enterprise applications. Now few modules are migrating to Java. Also in parallel, there has been stress on ensuring that the application has highest benchmark with ...
-1
votes
1answer
237 views

How to prevent code injection like automatically adding extra character? [closed]

Code: $result = "Hello World"; $jsonEncodeValue = $result; echo $jsonEncodedValue; Assumed Output: "Hello World" Real Output: \n"Hello World" This \n Line Feed added automatically. For this ...
1
vote
1answer
284 views

What is the fight-back mechanism in OSPF?

I want to know more about the fight-back security mechanism in OSPF routing protocol. When is the mechanism activated and how does it work? I found the source description of OSPF fight-back, but the ...
9
votes
2answers
436 views

Are you aware of any CEO that went to jail because of Security Flaws?

I need to make a real motivation for a security talk to a board of management. I know that in case a company ships products ignoring (so knowing and on purpose not caring) then it is held liable. ...
0
votes
2answers
293 views

CMS security issues

I have a desire to make my own CMS , to improve my programming skills. I would use PHP as a server side programming language. So my question is, on what security issues I must pay attention when ...
3
votes
3answers
109 views

Are mail-servers removed from security concerns in contrast with cloud storage?

I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
2
votes
1answer
1k views

cookie issue with same domain same path but different port

I have two web app running on same host on same path but on different port http://somedomain.com/ and https://somedomain.com/ now when I visit first app it serves the cookie say with name abc, and ...
3
votes
1answer
1k views

How to restrict SSH access outside of LAN? [closed]

We have several dedicated servers. We need to ensure "root" user can not be accessible through SSH outside of LAN. I have searched and found the followings # ...
3
votes
5answers
248 views

Is there any good (or less bad) way to handle a web portal or website with awful security?

Background: I'm facing a situation with an online site I must (for the immediate time being) use for financial and HR-related matters that just sucks. In every sense, but security in particular. As ...
1
vote
0answers
33 views

What is the smallest possible Windows shellcode? [duplicate]

Possible Duplicate: Are there any tools that focus on shellcode analysis? Any tools available that is for shellcode analysis? what methods are used in reverse engineering?
2
votes
2answers
8k views

How does Remote Access Trojan / Backdoor Software work?

How does the RAT works? I understand it as once we surf the infected website, browser might download the trojan to our PC automatically. Will it executed and auto install in our computer? I can't ...
16
votes
4answers
832 views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
0
votes
1answer
137 views

How much does network security audit and patch work? [closed]

how much is reasonable if i'm looking to hire someone FULL TIME to handle security auditing and patching for my network? I need my network to be PCI Compliance and what not as well. MY office have ...
1
vote
1answer
202 views

Can I bypass my own networked camera?

We have networked camera on my house. My brother is protected by user name and password. When I check my network in laptop, I can see the networked camera in my network but when I click to open, it ...
1
vote
2answers
878 views

Is there any good open source software for Security Risk Analysis?

Is there any good open source software for Security Risk Analysis? for example something like one explained on : http://www.security-risk-analysis.com/introduction.htm
14
votes
7answers
2k views

Tripwire - Is it security Theater?

Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes. Let's say I have tripwire configured to run ...
15
votes
7answers
303 views

Is a “security measure” that doesn't provide a security benefit actually harmful?

If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful? As an example, consider a login page where the user is asked to enter their ...