An actor, usually a person, who may attempt to exploit a vulnerability of an exposed system.
19
votes
5answers
940 views
Is having Steam installed a security risk?
Speaking to one of our security administrators at work, he insists that Steam is a well understood security risk and it shouldn't be installed on work machines.
Saying it's not work related I ...
15
votes
4answers
297 views
Detecting skimmers and other ATM traps
This question has been bothering me ever since I first heard of ATM skimmers:
Instances of skimming have been reported where the perpetrator has put
a device over the card slot* of an ATM ...
12
votes
2answers
357 views
Encryption and the “security time decay” of prior encrypted data
This question is on the assumption that any data once encrypted, may (eventually) be decrypted through
Brute force (compute power/time)
Exploits in the cryptography used
Theft of private keys
...
11
votes
3answers
696 views
Starting with sandbox development
I am looking for some security related project in which I can contribute and also learn something. Since I am new with this stuff It will be better if that project is less complex and digestible for a ...
10
votes
6answers
640 views
What are a few good lists of threats to use to kick-off conversations with others about what worries them?
To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...
10
votes
4answers
300 views
Resources for data on security incidents
What resources exist to research data on actual security incidents?
I would prefer an online resource but offline resources are acceptable. The cost of access should be less than $100 (US) for ...
8
votes
6answers
2k views
Security testing plan template or example
What does a security testing plan look like?
Can anyone point out a template for such a document or an example?
4
votes
5answers
396 views
What are the likely threats to a public-facing DB instance?
Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash.
We've been running an instance of MySQL internally for years and it's worked OK, but I ...
4
votes
6answers
492 views
What is the distinguishing point between a script kiddie and a hacker?
When I think of a script kiddie I think of someone who might barely research a tool then point it at a website - things like the recent question about LOIC come to mind when I think of that. A hacker ...
2
votes
1answer
104 views
SSL certificates published in Mandiant's APT1 report
You probably heard about excellent report "APT1: Exposing One of China's Cyber Espionage Units" published by the Mandiant company (you can download it here). Report is great and I recommend it to ...
2
votes
2answers
310 views
Vulnerabilities and Threats to Non Web Based Windows Applications
I believe that most people here are familiar with OWASP and their Top 10 project. When it comes to information systems these days it appears that there is a big focus on web application security and ...
1
vote
5answers
238 views
What is Non-Repudiation of content? How can we combat it?
Can anyone explain precisely the term of non-repudiation of content (eg. of email)? What sort of security requirement is used to combat this? Perhaps a digital signature?
This is how I understand ...
0
votes
2answers
226 views
How to check if a software is legitimate
if I have a developer who wants to install a new software and he ask me to check this software security before installing it what shall I do
0
votes
3answers
102 views
Security concept [closed]
How do we know that the systems that we are using are secure? At what point do we have to audit the software that we use? How do unknown security threats affect software over time?
