2
votes
2answers
238 views

Is WCF or Java Metro security configuration in-scope for your security department; should it be?

Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet. Given the port sharing abilities of IIS, or even that a web ...
10
votes
6answers
446 views

Should we configure all devices to never request SSL 2.0, and reject it if offered?

In an effort to reduce man in the middle attacks, when will it be (or was it) an industry accepted practice to reject SSL 2.0 connections on the client and server side? Is configuring this on a proxy ...
3
votes
2answers
3k views

Is it possible to change the admin user/password remotely on a router without logging in?

Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
7
votes
3answers
1k views

What does a court need to successfully prosecute a hacker? Please cite previous cases if possible

Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that: Integrity of the investigation is maintained The ...
6
votes
2answers
1k views

What are the security risks of the Service Bus, and how do you mitigate them?

The Service Bus is software that can be installed on Windows or rented on Azure and allows someone to relay SOAP/WCF information over the internet in the form of a XML over HTTPS payload. One risk ...
7
votes
2answers
490 views

What features do you look for in an Enterprise Log Management solution?

This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log ...
13
votes
1answer
5k views

Is SOCKS secure?

In order to create a VPN, I open an SSH tunnel with a command like ssh -D 9000 user@host, and then I set my system's proxy settings to use SOCKS5 through localhost:9000. Well, setting up my home ...
7
votes
2answers
691 views

Does DNSSec have any benefit if used with IPSec-enabled IPv6?

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec? Is DNSSec an IPv4-only technology?
6
votes
2answers
2k views

How do the root servers get updated with my name server? Is WhoIS information always in sync with the root?

I've never understood what happens behind the scenes when I go to my registrar and enter in my name server's information. Can someone elaborate on what happens when an update is made, and how it is ...
5
votes
1answer
189 views

When should a DNS entry be cached? What conditions should not be? How do I determine the TTL?

I'm writing a DNS resolver and am building a spreadsheet of when a DNS record should be cached, and not be cached... but it's harder than it first looks (to me at least). Is there consolidated test ...
5
votes
2answers
200 views

What risk do International Domain Names (IDN) pose?

I understand that IDN's are basically a GUI display change for domains that have a prefix of "xn--". What should I advise companies do in regards to these domains? For example, should companies ...
3
votes
2answers
167 views

What International laws should one in the InfoSec industry we be aware of?

What InfoSec regulations should one be aware of when dealing with 'live' cross-border communications, or the offline transport of information?
7
votes
5answers
2k views

What security requirements are a defacto standard in the Financial Industry?

What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry? If you're familliar with the Financial Industry, can you share details? For example: What ...
13
votes
2answers
14k views

What are the differences between the versions of TLS?

Please correct me if I'm wrong, but my understanding is that SSLv3 and TLSv1 is just a rename of the earlier protocol... but TLSv1 adds the ability to have secured and unsecured traffic on the same ...
4
votes
0answers
659 views

Best website to learn computer security basics? [duplicate]

Possible Duplicate: Resources to learn about security Can someone advice on which are the good sites out there to learn the basics of computer security from?
7
votes
2answers
471 views

I am looking for feedback on Secure Development Lifecycle for Scrum that has been tested?

This question is indeed targeting SDL but for Scrum. The A-SDL from Microsoft is nice, but honestly I am not even daring testing it in reality as it seems too academic. I mean what they request for, ...
7
votes
2answers
152 views

“Fingerprinting” and human error

Pretend for a moment I am investigating an attack. I find errors in the attack method (mistakes made by the human attacking my network/computer). I compile a database of these "mistakes" treating ...
17
votes
3answers
1k views

Multi factor authentication on Ubuntu workstations, where to start?

Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed) ...
2
votes
2answers
941 views

Is it possible to take down a site using javascript in the URL bar?

If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?
4
votes
3answers
343 views

Strategy against browser exploits on Windows?

On a friend's computer is some kind of spam bot installed. It sends messages like Hello: I received my apple iPad 32GB ordered on an online shop (www.elevalley.com ) today. So exciting ...
17
votes
6answers
570 views

What policies maximize employee buy-in to security?

Security awareness training is a bane to most employees. A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from ...
44
votes
38answers
8k views

What is your way to create good passwords that can actually be remembered?

What are the methodologies which can be used to generate "human" good quality password? They have to ensure a good strength and also easy to remember for a human being.
3
votes
2answers
224 views

How does LiveID work? Is there any documentation on the LiveID provisioning site msm.live.com?

I'm trying to learn details on how LiveID works, when compared to other federation technologies. To be honest, I'm a bit overwhelmed by all the options at https://msm.live.com/ and want to understand ...
3
votes
3answers
3k views

What is the exact difference between SAMLp and WS-Trust?

They seem to be similar on the surface, but I'm not sure how deep the differences are. Can someone explain to me the difference between SAMLp and WS-Trust? ADFSv2 gives me a choice between these ...
0
votes
1answer
806 views

How can I decrypt ADFS-based SAML/p or WS-Trust claims?

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication. What private keys do I need and how would I decrypt this information? If it makes any difference, I'm ...
3
votes
3answers
3k views

How does a website owner decrypt ASP.NET's Viewstate, and cookies

I'd like to audit my viewstate for information I don't want to be sent down to the client. What are the steps needed to decrypt this information into human readable form? How would I decrypt the ...
6
votes
3answers
2k views

What's involved in taking over someone else's domain name?

I'm asking this for purely academic reasons. I know that there are domain record lists and whatnot, but I'm trying to understand the exact structure of how DNS works and where someone can potentially ...
2
votes
3answers
121 views

Is it necessary to protect user data if they know and agree to it being insecure?

If I'm running a website that, say, takes a survey, must I protect user data from disclosure if the users are informed initially that it's insecure? I'm not storing financial data or social security ...
15
votes
8answers
3k views

Why do people say that PHP is inherently insecure?

I've heard it said that PHP is inherently insecure. Is this true? Why?
8
votes
3answers
688 views

How does an attacker approach a website?

What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?
6
votes
3answers
175 views

What policies maximize incident detection (and compromise detection)?

What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
10
votes
2answers
430 views

What is considered the simplest (or lightest) secure development lifecycle?

Microsoft has there simplified SDL: "The Security Development Lifecycle (SDL) is a security assurance process that is focused on software development." "The process outlined in this paper ...
18
votes
5answers
1k views

Does PCI compliance really reduce risk and improve security?

Might as well bring this hot topic to here! For those not in the know: https://www.pcisecuritystandards.org/
2
votes
4answers
395 views

Does outsourcing infrastructure services reduce risk (and improve security)?

I've been on a kick mentioning to particular clients to quit managing their own dns, email, blogging platform, file transfer setup, etc. This from observing how poor they are at practicing good ...
4
votes
2answers
319 views

FrameBusting script

It is commonly known that loading your site inside a frame on another site, can potentially expose your site to all kinds of ills, and in general is not a good idea if you have any sensitive data to ...
5
votes
3answers
462 views

Is randomizing cookie names a good idea?

What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
3
votes
3answers
292 views

Which languages are better for attacks against websites?

Which languages are better for writing tools for attacking websites, through, say, a DDOS? High level, low level, and does it even make a difference?
6
votes
2answers
222 views

How is the password prompt going to protect me from ruining my computer?

On Unix based systems, I'm often prompted to enter my password before installing or running a program. Why does this protect me? If I'm running a kiosk, I understand that a password might prevent ...
9
votes
2answers
396 views

How is UAC a security improvement?

What does User Account Control on Windows offer in terms of security? It's just an extra click to potentially run a virus.
17
votes
4answers
4k views

What is the corrupted image vulnerability? How does it work?

What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
5
votes
2answers
389 views

What protects cookies?

What protects cookies from being stolen? After all, they are just text files. A misbehaving browser can give up a lot more information that web masters would like. How do I know that a browser won't ...
9
votes
2answers
305 views

Why is FireSheep such a big deal?

We've had WireShark and other tools for a long time before. Why does everybody make such a big deal about FireSheep?
8
votes
4answers
539 views

How should I escalate a vulnerability that is dismissed by the vendor?

I've come across a vulnerability that secure@microsoft does not think is worth pursuing. I would estimate that there are many, many customers affected by this issue. I do not want to start a ...
7
votes
4answers
2k views

How effective is iPhone 3GS and 4 device-at-rest encryption?

My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device. In that context how effective is iPhone 3GS and 4 encryption?
3
votes
5answers
449 views

Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?

This is a multi-part question.... In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better? ...
3
votes
2answers
901 views

Encrypting a Database's Primary Key when sent to the browser

When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client... Can someone explain to me be benefits ...
8
votes
1answer
167 views

What was the issue the UAE had with RIM/Blackberry and what was the outcome? What countries have similar agreements?

I'd like to understand what came out of UAE's desire to monitor RIM traffic, and what technical compromise was made. Do other countries have similar agreements with RIM? What are the details? ...
7
votes
4answers
672 views

What security settings are likely used in Obama's Blackberry?

It's widely publicised that Obama has a blackberry, but it isn't clear to me what security settings are employed by the NSA or what private businesses can learn from his configuration? What is known, ...
60
votes
18answers
4k views

What security resources should a white-hat *developer* follow these days?

What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days? Do Include: Late breaking information on new security issues (RSS, Twitter, etc) A website that ...
21
votes
3answers
7k views

What are the best practices for hardening a php.ini file?

In order to secure a PHP installation, what are the best settings for a php.ini file? What is absolutely vital in terms of security? What is recommended for most use cases?

15 30 50 per page