11
votes
3answers
337 views

What risk analysis methodologies should I use?

I've heard of FAIR, and that seems pretty great. What other methodologies are there? How do they work? What are their benefits, and their drawbacks compared to others? When is each appropriate? ...
4
votes
4answers
679 views

What issues are most important to cover in Corporate Security Policy?

What about a Privacy Policy? Both internal, and external. From another Area51 proposal.
19
votes
10answers
1k views

Is it ever appropriate to fight back?

When an website or system is being attacked, is there ever a scenario where it should automatically take action against the attackers rather than just passively handling the attack? If so, what ...
16
votes
1answer
2k views

What is a Web Application Firewall?

What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
7
votes
1answer
310 views

How to properly generate and use (m)TANs?

If you have an application that uses transaction authentication numbers (TAN) or mobile TANs, how do you generate them correctly? What are the pitfalls? And should you only allow the next number on ...
13
votes
4answers
465 views

What are the most important security checks for new web applications?

I'm wondering what are the top priority security checks you should make befor launching a new webapp? I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
13
votes
2answers
790 views

How can I test my web application for timing attacks?

race conditions, etc. Are there automatic tools for this? What manual techniques should I use? From the Area51 proposal
19
votes
4answers
4k views

What tools are there to inspect Flash SWF files?

I am performing a penetration test against a website that uses Flash heavily. What tools can I use to examine the SWF file for vulnerabilities? From the Area51 proposal.
5
votes
2answers
852 views

How does OWASP ESAPI protect against direct object reference vulnerabilities?

What other good solutions are there? From the Area51 proposal
64
votes
2answers
13k views

What are rainbow tables and how are they used?

Where can I find one? Is there a pot of gold at the end? How do I protect against them? From the Area51 proposal This question was IT Security Question of the Week. Read the Sep 09, 2011 blog ...
11
votes
3answers
1k views

Is null-byte injection possible in Java filenames?

From the Area51 proposal
24
votes
3answers
776 views

What are the security risks in enabling ipv6

We are considering enabling ipv6 on our webservers, so that we are reachable with both ipv4 and ipv6. Are there any security issues we should consider when enabling ipv6?
3
votes
1answer
606 views

How many people are required to build your own 24x7 security operations center (SOC)? Rough costs?

I have received this question from a few clients, but I have 0 experience building a 24x7 SOC.
9
votes
3answers
534 views

What FOSS software do you like to use to build intrusion detection stacks?

Start-ups and organizations with limited budgets that are security conscious are often encouraged to deploy intrusion detection stacks. Given that prevention will always fail, intrusion detection ...
16
votes
4answers
2k views

Open-source penetration-test automation

Has anyone built a metascript, or a `script of scripts' useful during a penetration-test? Do you use Metasploit RC files? A network vulnerability scanner in a special way? A command-line, custom, or ...
2
votes
1answer
93 views

What does the Local exactly mean in CVSS?

CVSS (http://www.first.org/cvss/) provides the keyword local in the base vector. The definition given by FIRST is somehow not so clear for me: Local: Exploiting the vulnerability requires either ...
8
votes
4answers
555 views

What information should a error log record?

I want to populate my error log with useful information if and when errors occur. I'd like to use the log to be able to spot and fix bugs on my site, but also to potentially log hack attempts. For a ...
9
votes
3answers
569 views

What are a few good analogies to describe the benefits of a strong security program?

Given communication is king, what are some of the favorite analogies you like to use to describe the benefits of security to organizations needing security but new to security?
9
votes
3answers
730 views

How much money does it take to equip a fully funded black hat team? How much money to defend against such a team?

Richard Bejtlich wrote in July 2009 the following: "I submit that for $1 million per year an adversary could fund a Western-salaried black hat team that could penetrate and persist in roughly any ...
21
votes
3answers
2k views

Pitfalls of using OAuth for mobile Applications

OAuth seems to be getting a lot of traction at the moment as an authorization solution for web applications and mobile applications. I'm interested in understanding what the pitfalls of using OAuth ...
23
votes
1answer
15k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...
17
votes
10answers
1k views

What are security issues which are specific to cloud computing?

Moving almost everything to the Cloud gradually becomes a mainstream. Are there any security issues, which appeared together with this trend? What everybody should check out, from the security point ...
8
votes
1answer
417 views

What steps do you take to keep both your computer and internet browsing secure?

I am thinking about your browser setup, antivirus protection, vpn, browsing best-practices and so on.
21
votes
3answers
8k views

What benefits does Nessus have over OpenVAS?

Nessus and OpenVAS appear to have fairly similar features. Why would you choose one over the other, besides the benefit of commercial support (which isn't available for Nessus Home Feed users ...
30
votes
5answers
39k views

Advantages and disadvantages of Stream versus Block Ciphers

Encryption algorithms such as Blowfish,AES,RC4,DES and Seal are implemented in one of two categories of ciphers. What are the advantages/disadvantages to the type of ciphers?
9
votes
1answer
364 views

Which files are more insecure than others?

Regarding the fact (in case it's not always the proven fact, then an opinion) that there are types of files more safe for handling them after getting from the Internet than the other, i'd like to ask: ...
6
votes
2answers
947 views

Antivirus, antimalware and antispyware software. What is the difference?

What is the difference between antivirus, antimalware and antispyware software? If any clear distinction can be defined.
18
votes
4answers
1k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
11
votes
4answers
662 views

Vulnerabilities common only in mobile solutions?

I was wondering if there are any threats for web-applications used on mobile phones that haven't been known in the "full size" browsers earlier. I haven't heard of any serious or common problems that ...
8
votes
3answers
478 views

What security features should be present in every web-based CMS?

What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do? Please note: I'm looking ...
6
votes
3answers
316 views

How to open a file from the Internet in a secure way?

Sometimes I have to open files (doc, zip, txt, pdf and some other) downloaded from the Internet (from unproven sites) on my computer. How could I mitigate the risk and open them in a more or less ...
22
votes
6answers
1k views

Online password managers

Can online password managers be used for storing and managing passwords? I mean from the security point of view. I understand that those systems can be different and some deserves more trust than the ...
19
votes
2answers
4k views

How does a crypter for bypassing antivirus detection work?

I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?
18
votes
4answers
3k views

Malwares source repositories. Where?

As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
11
votes
2answers
2k views

How to test against DDoS in a controlled enviroment?

Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?
7
votes
3answers
2k views

Management Network Best Practices

I am looking at setting up a Management vlan, on which I will put all the Management interfaces for my various networkable devices (Firewall Mgmt Interfaces, Server RAC, WAP Mgmt Interfaces, etc). ...
24
votes
11answers
4k views

Resources to learn about security

I am currently just finishing a undergrad computer science degree, but I know very little about computer security. What are some good resources (aside from this site) to learn the fundamentals of ...
11
votes
5answers
3k views

What is the benefit with using encrypted RAM Memory?

I sometimes hear that encryption is used for the RAM Memory, but I don't really understand why this is needed. Why is RAM Memory needed to be encrypted? and is this done by the hardware, the ...
8
votes
4answers
3k views

How effective are reverse proxies as a web application security measure?

How effective are reverse proxies as a web application security device? Which types of threats do they mitigate against and which don't they? For example are they more effective in preventing ...
53
votes
13answers
11k views

What are the pros and cons of site wide SSL (https)?

What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
9
votes
3answers
753 views

If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?

In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
9
votes
2answers
2k views

How do I get started using ESAPI WAF?

I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
8
votes
1answer
556 views

Are browser still vulnerable to Cross-Site Cooking?

The latest article that I have been able to find about Cross-Site cooking was stating that it was possible to set cookie on 2 dots top level domain such as .co.uk. The mechanism for preventing ...
13
votes
4answers
6k views

Does a webserver need an antivirus software installed?

In what cases does a webserver need an antivirus software installed? When it is not required? If it is required sometimes, what should be considered when choosing the right one to install? (In my ...
7
votes
2answers
899 views

Recently had a virus, can I use backed up files on clean system?

I had to reinstall my OS (windows) recently due to a virus. I backed up my source files onto a flash drive. How can I get to those files without problems? I know flash drives can have nasty things in ...
24
votes
2answers
3k views

How can a Software application defend against DoS or DDoS?

Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
9
votes
4answers
291 views

Defending site against being abused by phishing

Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to ...
17
votes
3answers
2k views

What steps should be taken to validate user uploaded images within an application?

Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type. But what else can be done to ensure ...
27
votes
8answers
2k views

When a sysadmin leaves what extra precautions need to be taken?

If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials? Obviously there is also the standard ...
21
votes
3answers
560 views

Startup security

I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time ...

15 30 50 per page