The elimination or reduction of the frequency, magnitude, or severity of exposure to risks, or minimization of the potential impact of a threat or warning.
3
votes
2answers
301 views
Secure Software Development
I'm researching models on building security into the SDLC and so far have come across:
BSIMM
Microsoft SDL
Open SAMM
Are there any other documents and resources to look into? Specific tools that ...
6
votes
1answer
384 views
Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?
I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages.
...
8
votes
6answers
474 views
What is preventing the widespread common use of MAC-type systems?
Overall question
what is preventing the uptake of MAC systems such as SELinux/AppArmor in corporate and desktop computing environments?
Why don't you think it isn't already widespread?
I do not ...
6
votes
1answer
1k views
How does adding a random serial number improve a certificates' security?
This article says:
"Finding collisions is a tricky process, since it requires you to muck
with the bits of the public key embedded in the certificate (see this
paper for more details). Also, ...
6
votes
1answer
590 views
ASP.NET HTTP Response Splitting Attack
By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect:
...
7
votes
3answers
289 views
Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?
According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
3
votes
2answers
119 views
What steps can you take to make offline cracking of SRP harder?
In the aftermath of the Blizzard hack, what steps can I take to make offline cracking of SRP more difficult?
My question assumes that your database is already gone and that you implemented SRP more ...
1
vote
2answers
212 views
What are the risks of a rogue Access Point? What lessons can be learned from the Wifi Pineapple?
I'd like to educate colleagues and peers on rogue access points using the tool "Wifi Pineapple".
What are some specific security-related lessons I could demonstrate? If applicable, what are the ...
