76
votes
6answers
13k views

How much can I trust Tor?

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress. I am a political activist from India and I do not enjoy the freedom of ...
7
votes
3answers
967 views

How do I identify an unknown port/protocol that my IDS picks up?

Googling a port and protocol leads to a terse description at best, and a linkfarm in the average case. Most protocols on assorted, unknown high ports contain little or no plaintext, and often if the ...
6
votes
4answers
938 views

How can a company reduce exposure to packet spoofing? What solution should exist, but doesn't?

I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet. Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network ...
11
votes
5answers
2k views

Can Javascript/Flash verify the SSL connection to prevent “SSL Inspection”?

I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy. So some people may ask What is the point of re-validating SSL using javascript? ...
8
votes
3answers
205 views

What is the state of Security in Comp Sci Programs

In a previous question (How can I keep my programmer collegue informed about security issues ?) there was a statement: "...and I realise that security topics are often barely known from both the ...
17
votes
6answers
2k views

What security risks does IP spoofing bring?

By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
13
votes
5answers
1k views

How do you handle log analysis?

How do you handle log analysis in your business? I want to establish a good way of finding exceptions and alerts in the server logs, either automatically or semi automatic (having to review ...
13
votes
5answers
480 views

How can I keep my programmer collegues informed about security issues?

I am currently finishing a college degree in programming and I find that security topics are often barely understood by both students and teachers. It leads me to think that there are a lot of ...
6
votes
3answers
491 views

Are there any tools to detect JavaScript-based WCF/AJAX calls?

I'd like to determine if a given JavaScript contains the logic to make a AJAX/WCF call, or determine if one is being executed at runtime. Does anything like this exist?
4
votes
1answer
276 views

Anyone use the International Domain Name (IDN) security mitigation API's? Is there a wrapper for .NET?

The International Domain Name mitigation API's are available here for download: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=ad6158d7-ddba-416a-9109-07607425a815&displaylang=en ...
66
votes
9answers
13k views

Hardening Linux Server

We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH. To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
102
votes
8answers
43k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
4
votes
1answer
164 views

Security of rails user access/permissions plugins

I was wondering if anyone knows what the most secure user access plugin for Rails is, and if any of them prevent session fixation?
9
votes
2answers
1k views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
18
votes
5answers
328 views

What questions would the Joel test for Infosec professionals consist of?

See Server Fault and the original test. In other words what are some good questions that an information security professional should ask of a prospective employer? These questions might also lend ...
8
votes
5answers
184 views

Citations for inadvisability of globally unique password

I am looking for an authoritative source to back up my position in a disagreement over password policy. I am having a disagreement with a client about the user identification/authentication process ...
12
votes
4answers
1k views

MS-SQL Password Storage

What would be your recommendation for replacement of an MD5 hash approach to password storage within an MS-SQL database be?
20
votes
8answers
1k views

How to protect against brute forcing

How do you properly implement defenses against brute forcing? Is it best to store how many times someone tried to log in and block them after X attempts? And how would "someone" be identified? With ...
7
votes
1answer
434 views

Should iPhone backups be encrypted? Is this in-scope for Corporate IT if the device is linked to a home pc?

iPhone backups may reside on a computer that is outside of IT Policy (Home PC) and therefore doesn't have any Corporate IT protections on it. If this home PC was stolen or hacked, then the iPhone ...
7
votes
3answers
457 views

Popularity of Anomaly based IDSes

I've been reading quite some time about anomaly/behavior based IDSes for Web servers. I understand the downsides: possible high false positives, learning phase, constant training. My question is how ...
14
votes
1answer
1k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
5
votes
2answers
909 views

What is your approach to handling Guest Internet access?

Suppose you're a company that uses a web proxy to block objectionable content on your corporate network, and this technology may cause issues with some 3rd party VPNs. Or perhaps this 3rd party is ...
7
votes
3answers
660 views

Finding security consultant for doing in-depth code review?

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
3
votes
2answers
627 views

What personal traits and characteristics do you look for in a IT Security pro?

IT Security Pros are very smart people who need to give your environment with the respect and care that the business requires. Part 1 What are the traits you look for in an employee before ...
5
votes
6answers
7k views

Blocking insecure iPhones from accessing ActiveSync

Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint? In ...
5
votes
5answers
285 views

Does IT policy apply to the Board of Directors? What policies do apply?

What is your experience with applying IT policy to the Board of Directors? Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same ...
6
votes
1answer
320 views

Are NTFS Alternate File Streams considered a security risk in your organisation; how is it mitigated?

Alternate File Streams allows a user to embed hidden content within any NTFS file. That file can be a TXT file, or MOV for example. Some may consider this a form of steganography, and therefore the ...
6
votes
3answers
1k views

Secure hard drive disposal: How to erase confidential information

When it comes to disposing of hardware that may contain PII, confidential, or other sensitive material, how do you determine what needs special handling? What process do you use? I'd like to expand ...
4
votes
2answers
336 views

What criteria do you use for evaluating Client-Side / Endpoint security products?

What features are important to you in client-side AV and Firewall products? Who benefits from these features? Managment, the end user, helpdesk. Are there features that are being 'sold' by the ...
8
votes
4answers
494 views

Is it practical and worthwhile to alternate penetration test vendors?

Is it considered a best practice to alternate the vendor used to perform penetration tests? For example if it is your policy to conduct a third-party penetration test semi-annually you would have ...
34
votes
5answers
20k views

Are there security issues with embedding an HTTPS iframe on an HTTP page?

I've seen websites placing HTTPS iframes on HTTP pages. Are there any security concerns with this? Is it secure to transmit private information like credit card details in such a scheme (where the ...
38
votes
5answers
7k views

Are GUIDs safe for one-time tokens?

I see a lot of sites use GUIDs for password resets, unsubscribe requests and other forms of unique identification. Presumably they are appealing because they are easy to generate, unique, ...
15
votes
3answers
745 views

Getting a manual security code review done - What to watch out for?

We have a PHP application that we want to get code reviewed from an external security consultant, but I'm not clear on "how to" go about that process. We did specify what kind of tests he should be ...
4
votes
1answer
435 views

Do you know any .xry reader for MacOS/*BSD or Linux?

I am looking for a .xry reader (software) that works on mac/*bsd/linux in order to perform a forensic analysis. Can you suggest one?
7
votes
4answers
663 views

Is Stonesoft's “advanced evasion technique” a major problem?

A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques. With these techniques, they claim to be capable of launching attacks on a network ...
5
votes
4answers
1k views

Persisting and comparing NMAP scans

Does anyone have any good recommendations on a good tool for persisting NMAP scans to database? It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result ...
5
votes
1answer
114 views

What are the resources that an auditor would need to access in read mode?

Here a more concrete question: I am interested in documentation for an External Security Audit for ERP applications. What are the types of External Security Audit for ERP applications? What types ...
13
votes
1answer
4k views

SFTP, FTPS and SecureFTP differences and security implications

What are the basic differences and security implications of using SFTP, FTPS and SecureFTP.
17
votes
6answers
2k views

Anonymous web browser. Is it real?

Do anonymous browsers work? What principles do they use? Can I use them to test access to my web site? Can I detect if a visitor is using one? What is the different between traditional and anonymous ...
6
votes
1answer
1k views

Is there any recommended Java library for penetration testing?

Does anyone have any recommendations for a good Java library which can be used for penetration testing? I once read about a library which I think was called 'Attack lib' but I can't find it anymore. ...
10
votes
2answers
822 views

Why is Firesheep Unable to Session Hijack over SSL?

Why is Firesheep unable to session hijack when a user is using SSL?
12
votes
3answers
5k views

How much does a security audit cost? [closed]

For a PHP CMS, what should I expect to budget for a security audit, both whitebox and blackbox? The codebase is about 85,000 LOC ("Lines of Code") and I would probably use a North American company for ...
25
votes
6answers
463 views

How to keep an eye on upgrades, patches and security issues for used open-source libraries?

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
16
votes
6answers
9k views

How to set up a single sign-on for multiple domains?

I've set up a single-sign-on for two of our sites that live on the same domain: a.domain.com and b.domain.com I did it through cookies, but they are domain-dependant. And - as it is written in the ...
10
votes
5answers
3k views

How can I securely authenticate the client application sending me data?

We have a web service logging/recording user data sent over https by our client application. Is there a way to securely ensure that the data is getting sent by the client application and not by a fake ...
12
votes
3answers
664 views

Reporting vulnerable sites

Take this scenario: You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact ...
7
votes
4answers
911 views

Benefits of secure code review in-IDE vs. fatapp vs. webapp

For those of you who have worked with commercial secure code review tools such as: Klocwork Coverity Armorize Fortify Checkmarx Appscan Source Edition (formerly Ounce) Or perhaps a free or ...
13
votes
11answers
1k views

For users that does not use PGP, what would be the other channel to securely send them a document?

I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email. The real question is how to do that? ...
2
votes
5answers
1k views

Anyone using Asirra in production? Are there similar alternatives?

The Asirra project is a Captcha alternative that shows you pictures of kittens and puppies to fend off bots and prove that the end user is a human. Is anyone using Asirra (or something similar) in ...
22
votes
6answers
1k views

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...

15 30 50 per page