Hot answers tagged

21

Yes, it's a good idea: if you application allows it, it will make it possible to apply the principle of least privilege to a deployment, for instance by making sure the administrative interface can only be reached from "secure" networks. It can be further improved by applying the same principle all over the stack: using the OS and database security systems ...


4

I think Software Restriction Policies are what you're looking for. It is basically the predecessor to Applocker, and it is still supported for application whitelisting or blacklisting. It isn't as powerful or comprehensive as Applocker, but on Professional versions without Applocker, it can get the job done. See Spiceworks Guide on Deployment and Microsoft ...


1

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other website's cookies. This is fundamentally incorrect. I think you misunderstand the attack vector. A CSRF attack (also called "session riding") will typically ...


1

I suggest a more proactive approach as well by doing your own penetration testing against a non-production server setup specifically for this sort of thing. We use BurpSuite's scanner feature to test our own products - it has really helped augment our quest to find vulnerabilities. ZAP is a free alternative I've heard good things about, but have not ...


1

Like Stephane, I agree it can help your security, but it's go with an example: Let's say you have your "user data" somewhere in your application, that holds email addresses, usernames, and passwords. (Probably in a DB) You could create two DB accounts. One account is called "Nobody" and the other is called "Admin". "Nobody" is used by your normal site, ...


1

You have several choices. You can certainly do what you're planning, and tie the license to a MAC address. It doesn't take super hacker skills to reassign a MAC address, or to assign the same MAC address to a virtual adapter, but it is inconvenient to do so. It also would break their networking if those adapters are all on the same LAN. This approach ...



Only top voted, non community-wiki answers of a minimum length are eligible