The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
38 views

PDF encryption anomaly; version 1.5 using AES

I'm not sure if this is the correct forum to ask this question so please accept my apologies in advance if this is the wrong place. (I have already posted this in the Programmers section but I've yet ...
11
votes
7answers
214 views

What risk rating models are used for calculating risk scores of web vulnerabilities?

What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
0
votes
2answers
68 views

Certifying software as secure

What security certifications do major banks in the US expect an external software vendor to comply with? The software might form part of their payment processing system. ISO/IEC 27001 would apply to ...
3
votes
0answers
37 views

Protocols for transfering access control data

The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and ...
4
votes
1answer
72 views

How relevant is OWASP ASVS? [closed]

How relevant is the OWASP application security verification standard? Have you had it as a requirement made by business? What other application security standards relevant to business are there? I did ...
1
vote
0answers
41 views

How should I authenticate a third party's users on my platform?

I'm having trouble finding implementation ideas / guidance / examples for an authentication system that has the following properties: Allows a third party to carry out actions on our platform on ...
3
votes
2answers
100 views

Cybersecurity Server Stack references

I hear a lot of best practices saying that you should have 2 vSphere server stacks: One for Production One for Cybersecurity For example, your enterprise might have a vSphere environment stack that ...
8
votes
1answer
141 views

What is the current EU standard for data destruction?

I have been hunting around for a couple of weeks trying to find what the current standards for sensitive data destruction in the EU/UK are. If you look at the destruction companies they have several ...
0
votes
1answer
17 views

Are there Secure Coding Standards other that CERT? [closed]

I am familiar with the CERT Secure Coding Standart. Are there also any other secure coding standarts other than the CERT ones?
1
vote
1answer
23 views

History of the CERT secure coding standards? [closed]

My question is when and why did researchers decide to create the CERT secure coding standards? Is there anything about the history of this standards? I can't find anything about this.
21
votes
5answers
2k views

Policy mandate dilemma

When writing security policies do you take into consideration user's (could be vendors) ability/capability to fulfil certain mandates in the policies or do you strictly want them to enforce, no matter ...