The elimination or reduction of the frequency, magnitude, or severity of exposure to risks, or minimization of the potential impact of a threat or warning.

learn more… | top users | synonyms

1
vote
2answers
64 views

Is broadcasting your Windows computer name a vulnerability?

Some software I'm using sends out bug reports occasionally. The bug reports contain a fair bit of information. I'm concerned about some of the user identifiable information in the bug report. In ...
2
votes
1answer
43 views

Having malicious code stored in your DB

Let's say that there is a website which has an input field from which the input is saved to a database and then displayed somewhere else on the website. Is it safe to only sanitize/escape the ...
1
vote
0answers
14 views

SeaSponge Report Generation

I am trying out SeaSponge, a recently developed threat modelling tool which looks interesting. The entry is similar enough to Microsoft's SDL Threat Modelling Tool. However when I click on "Reports" ...
4
votes
1answer
39 views

What are best practices for secure admin access management to critical 3rd party cloud application in big companies?

I've always wondered how can we manage admin access to critical 3rd party resources (social media, SaaS CRM, etc) in big companies to mitigate: The administrator might leave the company without ...
128
votes
10answers
24k views

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

I received the following email, addressed to me at an email address on my personal domain (for which I run my own mail server on a VPS): FORWARD THIS MAIL TO WHOEVER IS IMPORTANT IN YOUR COMPANY ...
1
vote
1answer
56 views

Threat Modelling Examples (Distributed Systems)

I have threat modelled applications in the past, but I'd like to threat model a distributed system. However for other people I'm with, who have never done it at all, I'd like to check out some ...
1
vote
1answer
40 views

Spam protection for public GPG keys?

Public keys published to a server almost always contain emails. Is there any sort of protection against bot harvesters that will use that email for spam?
1
vote
2answers
74 views

Deep Packet Inspection: Any real world examples of threat mitigation via DPI? [closed]

So I understand conceptually how DPI works, but I'm a little skeptical regarding the actual benefits of this technology. Considering the possible risks associated with deploying DPI, i.e., decrypting ...
3
votes
2answers
140 views

Secure Android app development [closed]

I'm beginning with Android App development and I want to make sure that I'm taking the proper security precautions since most apps will handle sensitive data. What security precautions should be ...
1
vote
0answers
23 views

How do I stop MacBook port scanning & fragment packet attacks

How can I stop OSX El Capitan from port scanning and stop fragmented packet attacks?
1
vote
1answer
74 views

Usablity vs security malicious file upload

We were designing a web application which has the functionality similar to vulnerability management, our web application functionality can be briefed as follows: There is a panel where one can ...
0
votes
2answers
61 views

How do I protect a secret from rubber-hose cryptoanalysis?

So let's suppose I have a secret file. Assuming I don't remember/know the contents, how do I insure it is protected against the rubber-hose cryptoanalysis no matter what, even if I break under ...
3
votes
2answers
1k views

What OS's will “brick” a stolen phone; preventing their use or resale by a potential thief?

You can look at this question in two ways: Prior to purchasing a used phone, I want to ensure that the IMEI is not locked and I'm able to use it fully. Or you can be a purchaser who wants to devalue ...
2
votes
0answers
73 views

Open source firmware as mitigation against firmware persistent malware?

I am concerned about the threat of persistent malware entrenched in device firmware. I am not familiar with the intricacies of firmware security, so I am turning to SE for help. I recently learned of ...
1
vote
0answers
62 views

What is “Intentionally misleading Artificial Intelligence to create a misleading outcome” called?

I'm writing about a computer system that relies on Artificial Intelligence and the threats that this may include. One threat vector (for example) is to seed Bayesian AI with content to skew the ...
0
votes
3answers
221 views

How can i prevent my phone from spying through sms

Recently while reading up a article over here ,The following were the summary : hacking suite dubbed Smurf Suite, it can hack any mobile by sending an encrypted text message So based on the ...
2
votes
2answers
645 views

Odd url showing up in my pubsub stream, should I be concerned?

Background: Yesterday I started working on a simple metrics dashboard. I have a VBScript on my internal network that queries a database over a VPN from our Vendor. I then do a simple HTTP post to a ...
5
votes
2answers
98 views

Is there a HSTS equivalent for specifying TLS version?

HSTS allows me to force clients to connect to my website using HTTPS, but it doesn't specify the version of SSL, TLS, or what ciphers I'm prohibiting. Is there any HSTS alternative or extension that ...
3
votes
0answers
42 views

What is “half PFS” protection, and what protocols or configurations apply to it?

I'm looking for a list of scenarios and protocols that are vulnerable (or not vulnerable to) half-PFS protection. Half PFS, as I understand it, is where the communication between a client and server ...
1
vote
1answer
65 views

Is there a vulnerability when TLS is decrypted, then encrypted with OpenSSL that is vulnerable to BEAST or CRIME?

Assume that the following TLS proxy exists User <-----> Load Balancer that decrypts, encrypts <------> WebServer Where the web server is running a vulnerable version of OpenSSL. Can ...
3
votes
2answers
112 views

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

I need to discuss how to mitigate the risk of services which are vulnerable despite being patched (typically because they are not maintained by the vendor anymore, or because the vendor does not want ...
5
votes
2answers
2k views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

I need to provide evidence that CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation ...
1
vote
1answer
59 views

Data breach policy - immediate actions

We have a web application server and a database on AWS. Is there any "immediate action" policy somewhere we can adopt as to the steps we can take when we suspect or detect a data breach?
0
votes
2answers
102 views

Security devices other than firewall and IDS [closed]

I was just studying about firewalls and IDS/IPS and had a doubt. Are these the only two major security devices that a company invests in? or are there other equipment and security controls?
1
vote
1answer
115 views

Possible to use custom SSL or TCP/IP packets to detect VPN use?

What custom TCP/IP packets or other statistics can I use to detect VPN usage? I understand that this may generate a number of false positives, but my goal is to focus analysis on certain types of ...
3
votes
1answer
125 views

Is there an HSTS equivalent for DNSSec?

Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS? This would mitigate a DNSSec-strip attack (similar to SSLStrip) I'm also unclear if this ...
16
votes
2answers
821 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
2
votes
0answers
48 views

In DNSSec, are Delegation Signer Records always SHA-1?

I'm creating a RSA/SHA-512 Zone Signing Key and Key Signing Key at Dynect Managed DNS (corporate offering) The Delegation Signer Record that was created is SHA1. Should I be concerned about this?
6
votes
1answer
296 views

Is it unwise to use Redis to store PII, private keys, and other secrets?

I'm reviewing a system that is using Redis to store all client secrets, private keys, and other things. The problem is that Redis loads the entire DB into RAM Since SSL's heartbleed, Rowhammer, and ...
1
vote
2answers
529 views

Mitigation against MITM at Starbucks

Free public WiFi, for example Starbucks, is convenient. I wonder if there is a way to verify that a laptop has connected to the Starbucks wireless router and not to a man in the middle that tricked ...
4
votes
2answers
571 views

Possible to detect an/or shut off CryptoLocker by limiting total network bytes transferred?

Since a virus infected PC has to download (encrypt) reupload the entire file (to a file server), and repeat the process for every network drive, is is possible to detect this unusually high bandwidth ...
1
vote
0answers
171 views

Can a Radius server mitigate an ARP spoofing attack?

I'm helping my school network administrator to try to find a way to mitigate a current ARP spoofing attack on our wifi network. We detected an unknown host (MAC address seem to change, he is probably ...
1
vote
1answer
353 views

How does Wifi Blocking work? Can it be detected / prevented? [duplicate]

Marriott was accused of blocking personal Wifi access points by deauthenticat[ing] packets sent to targeted access points and thus to disrupt access to individual hotspots. Question How does ...
13
votes
2answers
2k views

Linux password changed. Is this an attack or a hardware glitch?

My Linux (Ubuntu 12.04) password suddenly changed last night and I'm not sure if this is an attack or just a hardware/user error. This is on a personal/non-server box. Several strange events led up to ...
1
vote
3answers
357 views

Installed some software over a public insecure wireless network — should I consider myself compromised?

A couple months earlier, I made the mistake of downloading some software over an insecure wireless network and running it without checking its integrity. I am now considering reinstalling my system, ...
1
vote
3answers
83 views

How can I mitigate attacks that rely on poisoned data as a developer?

A few years ago, there was a high-profile attack on a Wired editor, where the hackers added a credit card to the target's amazon account, then used that self-added credit card to gain access to the ...
8
votes
1answer
142 views

What considerations should apply for self service Renewing, Revoking, or Unrevoking a certificate?

I need to design a self service portal for renewing, revoking, and unrevoking a certificate and have come up with the following rules*: Renewal Certificates have a short term validity and need to ...
2
votes
2answers
161 views

What's the mitigation strategy for when a CA's private key is stolen?

I'm new to SSL/TSL and was wondering if you could walk me through the following scenario. Scenario Let's say I am one of a thousand websites that has a certificate signed by some certificate ...
3
votes
1answer
88 views

What crypto prevents & detects “invisible” CAs? (e.g. in X509v4)

For this question, I'm calling an "invisible CA" one that Is signed by a root ca and exists as a 2nd or 3rd tier Is valid, not expired or revoked Has a different Public key than one that is ...
48
votes
11answers
9k views

Are there “secure” languages? [closed]

Are there any programming languages that are designed to be robust against hacking? In other words, an application can be hacked due to a broken implementation, even though the design is perfect. ...
2
votes
2answers
2k views

How do I Mitigate Directory Traversal when User-Supplied Input is a Mandatory Business Case?

I have an instance where we have an application that requires the ability to set up sftp commands that are specified by administrative users. They are configured through the front-end of the ...
15
votes
8answers
21k views

Encrypting files on Google Drive

It's my understanding files kept on Google Drive are not protected. I would like to have them encrypted so that to be able to view or modify them one must enter a password. I foresee a potential ...
0
votes
1answer
319 views

Cryptic threat names

I have logs from a security appliance from Damballa which has cryptic names for threats observed in a network which I am trying to make sense of. Some examples of these threats are "RedTreeBruisers" , ...
6
votes
2answers
562 views

Stolen Laptop - Next steps

My laptop (modded 2007 Macbook Pro) was stolen 2 days ago when I didn't pay attention to my backpack in a tourist spot in Europe and while I'm quite certain they won't have much use for it (the apple ...
-1
votes
1answer
399 views

How secure are the new TLDs ( .us, .io, …) and do they compare to .com? [closed]

The introduction of the new top level domains (TLDs) such as .music, .books, etc. will increase the number of people and organisations adding and removing entries into the root DNS servers (.) for ...
1
vote
2answers
997 views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
3
votes
4answers
3k views

How to mitigate SSL based DDoS attacks?

as you probably know the problem with SSL based DDoS attacks is, that the traffic cannot be analysed and filtered by a DDoS mitigation service provider such as Prolexic, Akamai, Radware, etc. without ...
6
votes
2answers
6k views

How effective is the iOS “Send All Traffic to VPN” setting at deterring Wifi-based attacks?

iOS version 5 and newer has a setting for VPNs to "Send All Traffic" over that VPN. I think that sending all data to a trusted VPN target would ensure privacy of all communication sent over that WiFi ...
-2
votes
1answer
138 views

What are the security measures to be taken before launching a site with credit card payments? [closed]

We just completed functionality testing of our new e-commerce site and going to launch.We are accepting credit card payments. I'm really concerned about it's security.What are the precautions to be ...
8
votes
2answers
2k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...