Tag Info

New answers tagged

2

As Schroeder has mentioned there are a few security standards and frameworks which can be used. One thing you absolutely are REQUIRED to comply with by LAW in the U.S. (I see you live in New York) is HIPAA. Aside from that the ISO 27001 can provide you with a certification that you have a controlled security organization. There are different bodies that ...


2

There are a number of regulatory bodies that provide standards and auditing procedures to provide this kind of assurance (of varying degrees and focus): ISO 27000 COBIT NIST As you speak of 'patients', you need something short, understandable, and recognized. Laying out all the procedural details (like air-gapped workstations) isn't useful to anyone. ...


0

I agree with the previous answer. Typically controls either fall under an information security team or a controls team that is focused on developing and maintaining controls for the entire organization. Controls are typically created (as you mentioned) from a combination of Finance and IT, but should be owned/developed more from Finance since they ...


0

When the cookie is created by the web app, there are optional flags which can be set to restrict how the cookie is used. With no flags set, the cookies can be read over an insecure connection or may be used in unexpected and unplanned ways. To remediation your finding, you will need to ensure that the correct flags are set when the cookie is created. In a ...


0

A cookie that has the secure attribute set will only be sent over an HTTPS connection, so if the client in future attempts to connect to the server over unencrypted HTTP, the cookie will not be sent with the request, and will not, therefore, be exposed to theft. As to how to ensure your specific cookie is marked as secure, you will have to consult with ...


8

This is extremely unsafe, to the point of being pointless: Your hash function is not a one-way function. One can instantly (with constant and low runtime) calculate an input producing any given hash if you allow arbitrary 4 character passwords as inputs by undoing the XOR with the initial hash value formed from the password length. With a little ingenuity, ...


6

32 bit hash function cannot be possibly safe for the purpose of password verification. Problem here is that it is "easy" to find a colliding password, that is, a password, that hashes to the "correct" hash value despite being different from the original password. On average it will take 2^31 password trials to get such collision, which is considered very ...



Top 50 recent answers are included