DO NOT USE THIS TAG AS A GENERIC SECURITY TAG!! Security theater is a term that describes security countermeasures intended to provide the feeling of improved security while doing little or nothing to actually improve security. The term was coined by computer security specialist and writer Bruce ...

learn more… | top users | synonyms (1)

-1
votes
1answer
314 views

How to prevent code injection like automatically adding extra character? [closed]

Code: $result = "Hello World"; $jsonEncodeValue = $result; echo $jsonEncodedValue; Assumed Output: "Hello World" Real Output: \n"Hello World" This \n Line Feed added automatically. For this ...
1
vote
1answer
519 views

What is the fight-back mechanism in OSPF?

I want to know more about the fight-back security mechanism in OSPF routing protocol. When is the mechanism activated and how does it work? I found the source description of OSPF fight-back, but the ...
12
votes
2answers
660 views

Are you aware of any CEO that went to jail because of Security Flaws?

I need to make a real motivation for a security talk to a board of management. I know that in case a company ships products ignoring (so knowing and on purpose not caring) then it is held liable. ...
0
votes
2answers
435 views

CMS security issues

I have a desire to make my own CMS , to improve my programming skills. I would use PHP as a server side programming language. So my question is, on what security issues I must pay attention when ...
3
votes
3answers
123 views

Are mail-servers removed from security concerns in contrast with cloud storage?

I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
3
votes
1answer
3k views

cookie issue with same domain same path but different port

I have two web app running on same host on same path but on different port http://somedomain.com/ and https://somedomain.com/ now when I visit first app it serves the cookie say with name abc, and ...
3
votes
1answer
3k views

How to restrict SSH access outside of LAN? [closed]

We have several dedicated servers. We need to ensure "root" user can not be accessible through SSH outside of LAN. I have searched and found the followings # ...
3
votes
5answers
311 views

Is there any good (or less bad) way to handle a web portal or website with awful security?

Background: I'm facing a situation with an online site I must (for the immediate time being) use for financial and HR-related matters that just sucks. In every sense, but security in particular. As ...
1
vote
0answers
35 views

What is the smallest possible Windows shellcode? [duplicate]

Possible Duplicate: Are there any tools that focus on shellcode analysis? Any tools available that is for shellcode analysis? what methods are used in reverse engineering?
2
votes
2answers
17k views

How does Remote Access Trojan / Backdoor Software work?

How does a RAT works? I understand it as once we visit the infected website, the browser might download the Trojan to our PC automatically. Will it be executed and auto-installed in our computer? I ...
24
votes
4answers
4k views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
0
votes
1answer
146 views

How much does network security audit and patch work? [closed]

how much is reasonable if i'm looking to hire someone FULL TIME to handle security auditing and patching for my network? I need my network to be PCI Compliance and what not as well. MY office have ...
1
vote
1answer
278 views

Can I bypass my own networked camera?

We have networked camera on my house. My brother is protected by user name and password. When I check my network in laptop, I can see the networked camera in my network but when I click to open, it ...
0
votes
2answers
2k views

Is there any good open source software for Security Risk Analysis?

Is there any good open source software for Security Risk Analysis? for example something like one explained on : http://www.security-risk-analysis.com/introduction.htm
17
votes
7answers
3k views

Tripwire - Is it security Theater?

Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes. Let's say I have tripwire configured to run ...
15
votes
7answers
372 views

Is a “security measure” that doesn't provide a security benefit actually harmful?

If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful? As an example, consider a login page where the user is asked to enter their ...