The elimination or reduction of the frequency, magnitude, or severity of exposure to risks, or minimization of the potential impact of a threat or warning.

learn more… | top users | synonyms

4
votes
3answers
1k views

What OS's will “brick” a stolen phone; preventing their use or resale by a potential thief?

You can look at this question in two ways: Prior to purchasing a used phone, I want to ensure that the IMEI is not locked and I'm able to use it fully. Or you can be a purchaser who wants to devalue ...
1
vote
1answer
60 views

Data breach policy - immediate actions

We have a web application server and a database on AWS. Is there any "immediate action" policy somewhere we can adopt as to the steps we can take when we suspect or detect a data breach?
3
votes
0answers
43 views

What is “half PFS” protection, and what protocols or configurations apply to it?

I'm looking for a list of scenarios and protocols that are vulnerable (or not vulnerable to) half-PFS protection. Half PFS, as I understand it, is where the communication between a client and server ...
2
votes
0answers
77 views

Open source firmware as mitigation against firmware persistent malware?

I am concerned about the threat of persistent malware entrenched in device firmware. I am not familiar with the intricacies of firmware security, so I am turning to SE for help. I recently learned of ...
2
votes
0answers
49 views

In DNSSec, are Delegation Signer Records always SHA-1?

I'm creating a RSA/SHA-512 Zone Signing Key and Key Signing Key at Dynect Managed DNS (corporate offering) The Delegation Signer Record that was created is SHA1. Should I be concerned about this?
1
vote
0answers
15 views

SeaSponge Report Generation

I am trying out SeaSponge, a recently developed threat modelling tool which looks interesting. The entry is similar enough to Microsoft's SDL Threat Modelling Tool. However when I click on "Reports" ...
1
vote
0answers
23 views

How do I stop MacBook port scanning & fragment packet attacks

How can I stop OSX El Capitan from port scanning and stop fragmented packet attacks?
1
vote
0answers
62 views

What is “Intentionally misleading Artificial Intelligence to create a misleading outcome” called?

I'm writing about a computer system that relies on Artificial Intelligence and the threats that this may include. One threat vector (for example) is to seed Bayesian AI with content to skew the ...
1
vote
0answers
173 views

Can a Radius server mitigate an ARP spoofing attack?

I'm helping my school network administrator to try to find a way to mitigate a current ARP spoofing attack on our wifi network. We detected an unknown host (MAC address seem to change, he is probably ...
0
votes
0answers
31 views

Mitigation for web service that may impersonate the context of native application?

I am trying to create threat model, and I have one of the threat listed as follows: Web Service - may be able to impersonate the context of Native Application. Can some one please help to ...