11
votes
3answers
328 views

What are the pros/cons of using a threat detection system?

What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)? What does a properly implemented threat detection system do and how does it behave when it detects ...
19
votes
1answer
824 views

Is it secure to connect to a remote Windows Server using Remote Desktop only?

I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
28
votes
2answers
25k views

How can I check that my cookies are only sent over encrypted https and not http?

I read a blog post GitHub moves to SSL, but remains Firesheepable that claimed that cookies can be sent unencrypted over http even if the site is only using https. They write that a cookie should be ...
15
votes
8answers
1k views

Password management/synchronization?

Is there a good enough service I could run on my own home (Linux) server that I could use for storing/accessing/synchronizing passwords so they could be available for me from multiple ...
17
votes
5answers
1k views

Is Google Chrome a better secured browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast. Is it really Chrome so good or it was not tested? Has anyone other results of independent investigations about security of web browsers? ...
27
votes
5answers
3k views

Professional certifications for IT Security

Which credentials of the sub-list of IT certifications (as per the Information Systems Security Association) would be considered MUST HAVE for a IT Security specialist. Information Security CEH ...
28
votes
6answers
5k views

Does it matter which Certificate Authority I source my SSL Certificate from?

To secure my web site with HTTPS, does it matter which company I source my SSL certificate from, or just that the browser recognizes it? From the Area51 proposal.
30
votes
9answers
19k views

Feeding /dev/random entropy pool?

Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
21
votes
9answers
2k views

What cryptographic algorithms are not considered secure?

What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
86
votes
11answers
20k views

Apache Server Hardening

What are some best practices, recommendations, required reading for securing an Apache Server?
21
votes
5answers
1k views

Designing in zero day attack mitigations

What are best practices / recommendations / strategies for mitigating zero day threats/attacks from a software development perspective?
11
votes
7answers
839 views

IP address black list

My website has a black list of IP addresses. The web application, in some way, detects all invalid, suspicious influences to it and remembers IP address and denies any requests from that IP address. ...
17
votes
4answers
2k views

How to keep a shared web hosting server secure?

What are the ways of keeping a shared LAMP server secure, assuming SSH access is available for every user? Edit: I am mainly thinking of securing the server from the users themselves and between ...
40
votes
6answers
3k views

How to disclose a security vulnerability in an ethical fashion?

How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
19
votes
5answers
773 views

What is the best option for setting up a several sites supporting SSL on the same IP?

If multiple hostnames are hosted on the same IP, it's not straight forward to allow them to support https. What are the best options in terms of browser support and/or web server support?
39
votes
5answers
7k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
19
votes
5answers
1k views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
39
votes
8answers
3k views

What methods are available for securing SSH?

What methods are available for securing SSH?
12
votes
3answers
1k views

Asp.net mvc security check list

I am planning to start a new web site on asp.net mvc 2 (3). Have anybody a full (if possible) check list of actions, approaches I should reach to avoid almost problems with security.
21
votes
5answers
3k views

Should I use Suhosin for PHP?

Suhosin can be used to increase the security of your php application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps ...
11
votes
3answers
11k views

Which webserver is more secure, Apache, nginx or lighttpd?

We are trying to decide which webserver to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
32
votes
5answers
5k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
25
votes
6answers
430 views

User input data, is filtering enough or should it be parsed?

In a webapplication there could be two approaches to migate XSS attacks. All the input data could be filtered (removing all 'bad' data), or the input could be parsed, tokenized and output with only ...
77
votes
17answers
11k views

Does an established ssl connection mean a line is really secure

From the view of somebody offering a webapplication. When somebody connects with SSL (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
18
votes
3answers
1k views

Rails - protection against code injection and XSS

I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS? I know Rails tries to prevent ...
30
votes
13answers
1k views

Courses on “Secure Software Development”

This semester, I'm offering a course on "secure software development." The course is divided into three parts: Secure Software Engineering Reverse Engineering Secure Coding Do you know any courses ...
9
votes
3answers
255 views

Are bookmarklets safe with facebook data?

I usually play mafia wars and use bookmarklet like Spockholm, Arum, etc. Can these bookmarklet get my facebook data when I run them, they usually ask to unframe the facebook page. I was just ...
327
votes
4answers
102k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
13
votes
6answers
2k views

Does prepending a salt to the password instead of inserting it in the middle decrease security?

I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
12
votes
4answers
763 views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks Is the presence of wireless access points tested for by using a wireless analyzer at ...

15 30 50 per page