New answers tagged

1

Certificate Pinning is another commonly used control against Data-in-transit attacks. The TLS handshake never starts if the client doesn't receive a Public Key that is within the client's (the mobile app) known Pin List. I used Cert Pinning as a compliment to payload encryption. Perhaps the following are becoming the base standard for sensitive mobile app ...


1

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other website's cookies. This is fundamentally incorrect. I think you misunderstand the attack vector. A CSRF attack (also called "session riding") will typically ...


0

Ever heard of RSA? Much more safe and much more simple. Every client generates an private key and sends its public key to the server. The client that starts a group generates an AES key for encrypting group files and decrypts the key with each public key of the other members. Than it sends the encrypted keys to the other members. They use their private key ...


0

This is something I've been wondering about as well. I don't think a solution exists right now, but I believe new systems can be designed to do this without downtime by leveraging Trust Assertions for Certificate Keys (TACK) to do so. When the client decides to cycle to a new secret we need a mechanism to ensure the server can trust the new secret. In other ...


1

I suggest a more proactive approach as well by doing your own penetration testing against a non-production server setup specifically for this sort of thing. We use BurpSuite's scanner feature to test our own products - it has really helped augment our quest to find vulnerabilities. ZAP is a free alternative I've heard good things about, but have not ...


0

It sounds like you are worried about your web server code trusting a third party library that generates content within your HTTP response. This is a very valid concern. If all that it generates is CSRF tokens, i.e. some strings, it makes sense to add XSS protection (whitelisting chars, escaping special characters ...). This should eliminate most of the ...


4

I think Software Restriction Policies are what you're looking for. It is basically the predecessor to Applocker, and it is still supported for application whitelisting or blacklisting. It isn't as powerful or comprehensive as Applocker, but on Professional versions without Applocker, it can get the job done. See Spiceworks Guide on Deployment and Microsoft ...


1

Like Stephane, I agree it can help your security, but it's go with an example: Let's say you have your "user data" somewhere in your application, that holds email addresses, usernames, and passwords. (Probably in a DB) You could create two DB accounts. One account is called "Nobody" and the other is called "Admin". "Nobody" is used by your normal site, ...


21

Yes, it's a good idea: if you application allows it, it will make it possible to apply the principle of least privilege to a deployment, for instance by making sure the administrative interface can only be reached from "secure" networks. It can be further improved by applying the same principle all over the stack: using the OS and database security systems ...



Top 50 recent answers are included