All Questions

8
votes
3answers
591 views

How does an attacker approach a website?

What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?
5
votes
3answers
146 views

What policies maximize incident detection (and compromise detection)?

What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
9
votes
2answers
325 views

What is considered the simplest (or lightest) secure development lifecycle?

Microsoft has there simplified SDL: "The Security Development Lifecycle (SDL) is a security assurance process that is focused on software development." "The process outlined in this paper ...
18
votes
5answers
1k views

Does PCI compliance really reduce risk and improve security?

Might as well bring this hot topic to here! For those not in the know: https://www.pcisecuritystandards.org/
2
votes
4answers
347 views

Does outsourcing infrastructure services reduce risk (and improve security)?

I've been on a kick mentioning to particular clients to quit managing their own dns, email, blogging platform, file transfer setup, etc. This from observing how poor they are at practicing good ...
3
votes
2answers
260 views

FrameBusting script

It is commonly known that loading your site inside a frame on another site, can potentially expose your site to all kinds of ills, and in general is not a good idea if you have any sensitive data to ...
5
votes
3answers
330 views

Is randomizing cookie names a good idea?

What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
2
votes
3answers
253 views

Which languages are better for attacks against websites?

Which languages are better for writing tools for attacking websites, through, say, a DDOS? High level, low level, and does it even make a difference?
5
votes
2answers
167 views

How is the password prompt going to protect me from ruining my computer?

On Unix based systems, I'm often prompted to enter my password before installing or running a program. Why does this protect me? If I'm running a kiosk, I understand that a password might prevent ...
7
votes
2answers
327 views

How is UAC a security improvement?

What does User Account Control on Windows offer in terms of security? It's just an extra click to potentially run a virus.
16
votes
4answers
3k views

What is the corrupted image vulnerability? How does it work?

What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
5
votes
2answers
341 views

What protects cookies?

What protects cookies from being stolen? After all, they are just text files. A misbehaving browser can give up a lot more information that web masters would like. How do I know that a browser won't ...
8
votes
2answers
255 views

Why is FireSheep such a big deal?

We've had WireShark and other tools for a long time before. Why does everybody make such a big deal about FireSheep?
7
votes
4answers
433 views

How should I escalate a vulnerability that is dismissed by the vendor?

I've come across a vulnerability that secure@microsoft does not think is worth pursuing. I would estimate that there are many, many customers affected by this issue. I do not want to start a ...
7
votes
4answers
2k views

How effective is iPhone 3GS and 4 device-at-rest encryption?

My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device. In that context how effective is iPhone 3GS and 4 encryption?
3
votes
5answers
400 views

Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?

This is a multi-part question.... In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better? ...
2
votes
2answers
757 views

Encrypting a Database's Primary Key when sent to the browser

When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client... Can someone explain to me be benefits ...
7
votes
1answer
134 views

What was the issue the UAE had with RIM/Blackberry and what was the outcome? What countries have similar agreements?

I'd like to understand what came out of UAE's desire to monitor RIM traffic, and what technical compromise was made. Do other countries have similar agreements with RIM? What are the details? ...
7
votes
4answers
612 views

What security settings are likely used in Obama's Blackberry?

It's widely publicised that Obama has a blackberry, but it isn't clear to me what security settings are employed by the NSA or what private businesses can learn from his configuration? What is known, ...
58
votes
18answers
4k views

What security resources should a white-hat *developer* follow these days?

What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days? Do Include: Late breaking information on new security issues (RSS, Twitter, etc) A website that ...
20
votes
3answers
6k views

What are the best practices for hardening a php.ini file?

In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?
10
votes
2answers
574 views

Tools and methodologies to share pentest and/or source code analysis results

I would like to hear from you which tools (commercial and open source) do you use to share results during collaborative penetration test or source code/binary analysis. Well-known Dradis framework ...
16
votes
4answers
2k views

Does stored procedure prevent SQL Injection in postgreSQL

Is it true that stored procedure will prevent databases from being injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injections if we only ...
14
votes
4answers
582 views

Database Encryption Security

I am encrypting and decrypting my database data from my web applications API. If my web server is compromised, what is to keep someone from using that same method to retrieve the data? For example, ...
6
votes
2answers
838 views

How effective is the Mac Open Firmware password protection?

I have used Mac's Open Firmware password protection before and I've always wondered how effective it actually is at protecting my stuff. [assuming a good password] Would does the firmware password ...
5
votes
8answers
3k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
4
votes
0answers
1k views

Hints for safe passwords that are easy to remember [duplicate]

Possible Duplicate: What is your way to create good passwords that can actually be remembered? What are good hints to create passwords that are both safe and comfortable? By comfortable I ...
9
votes
1answer
265 views

What shell binary should I use for the root account on a Linux system?

Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?
12
votes
4answers
579 views

What does defense in depth entail for a web app?

I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level ...
15
votes
5answers
2k views

The aescrypt implementation hashes a password 8192 times to generate the key. Is this necessary?

I'm considering encrypting some small files (hundreds of kb apiece) using the aescrypt reference implementation. Looking at the source, it seems that the encryption key is derived from the IV and the ...
17
votes
5answers
418 views

What are good ways to educate about IT security in a company?

I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's ...
16
votes
3answers
3k views

What are the security risks of letting the users upload content to my site?

As a web designer (not a security expert) I wonder: If I allow users to upload content to my website (videos, images and text files), what are the real risks involved?
67
votes
13answers
16k views

Why do sites implement locking after 3 failed password attempts?

I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
21
votes
6answers
1k views

Is there a guide of general/common IT vulnerabilities?

I'm looking for an updated and comprehensive guide of general/common IT vulnerabilities (general information). I do not want you to do the job for me, I just want to point me in the right direction: ...
20
votes
7answers
858 views

How can I protect a WordPress installation?

How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome.
13
votes
4answers
375 views

Stop software updates after the system is “stable”?

Yesterday morning I had an OS class and we just started the part about OS security. When the professor was explaining what is a patch manager, he told us that a computer company he knows which deals ...
18
votes
8answers
1k views

Ways to secure yourself from Firesheep kiddies and other sniffing

Just a few days ago I had my first encounter with Firesheep. Luckily I was the one using it. Well, it scared me into looking for ways to secure myself. So I have two questions: In exactly what ...
15
votes
7answers
306 views

Is a “security measure” that doesn't provide a security benefit actually harmful?

If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful? As an example, consider a login page where the user is asked to enter their ...
10
votes
2answers
462 views

Risks of Using Google Native Client

I was wondering if there were any possible risks in using Google Native Client. I know it is sandboxed, but the idea still seems risky, and at least leaves another route open for compromising your ...
7
votes
4answers
448 views

How big is the risk, to enable scripting in the Web browser?

While browsing the web, many websites executes scripts (mainly javascript) that are executed without the user noticing. How big is the risk, to get Malware unnoticed while surfing with scripting ...
16
votes
8answers
1k views

Are signature based antivirus or antimalware effective?

Are signature based antivirus or antimalware solutions effective? Has the battle been lost against the ever increasing amount of malware, particularly rootkits, that are in the wild?
11
votes
5answers
231 views

What are the areas to focus on to protect users and devices?

What are the areas or technologies to focus on to protect users and devices? Are patching, antivirus and firewalls still the main areas? How do you defend against attacks against vulnerabilities ...
9
votes
4answers
859 views

RBAC model: user in two roles access dilemma

I am implementing the Role-Based Access Control (RBAC) model security system and I have a dilemma: one User1 is in Role1 and is in Role2. Role1 allows access to the Resource1 and Role2 denies access ...
12
votes
7answers
534 views

Is the law the only thing stopping many sites from being hacked/cracked?

There are so many common vulnerabilities out there, so how is it that every Wordpress blog, for example, isn't hacked into often? It seems like the security community is overly paranoid, unless the ...
21
votes
7answers
9k views

If you could have only one book on web security, what would it be?

If you could have only one book on web security, what would it be?
10
votes
3answers
799 views

If an XML document is not validated as “Well Formed” or checked against a schema, what are the risks?

When processing an XML document in my application, what are the risks? E.g. if it is not "Well Formed" or is not checked against a schema.
26
votes
4answers
4k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
70
votes
6answers
31k views

How should I distribute my public key?

I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
7
votes
2answers
357 views

What key metrics should a CIO rely on to gauge the extent of IT risk exposure?

Note - This was originally asked in another Area51 proposal, which has since been deleted.
11
votes
3answers
337 views

What risk analysis methodologies should I use?

I've heard of FAIR, and that seems pretty great. What other methodologies are there? How do they work? What are their benefits, and their drawbacks compared to others? When is each appropriate? ...

15 30 50 per page