Tag Info

New answers tagged

1

The ISO 2700X series is about certifying the security management of a company. You are certified on the 27001 by the way. The scope is to be defined by the company. To do so, you implement the requirements of the norm (chapters 4 to 8) without exception. Chapter 4 revolves around the Deming circle (PDCA) and defines the ISMS set-up, implementation and ...


2

Bitlocker uses AES in CBC mode, Truecrypt and others use AES/Twofish/Serpent/cascades in XTS mode (Wikipedia: Block cipher mode of operation). CBC mode is less secure in that it allows single bit manipulation, for example switching a specific bit of data when attacker can gain physical access to the machine then return it to you. This can open backdoor ...


0

You are absolutely correct in your first question that security controls can be categorized in many different manners, and that a particular security control could possibly fall into several of those categorizations. There is no absolute universally agreed-to set of categories either, some are older categorizations that made sense in the 1990s and 2000s, ...


4

HTTPOnly disallows the cookie from being read by JavaScript via document.coookie. The Secure flag will restrict the cookie to HTTPS, but if your site has an XSS vulnerability, HTTPS will not protect you. The XSS URL https://example.com?q=<script>alert(document.cookie)</script> works just as well as ...


7

It is unknown (except probably to Microsoft and the NSA) whether BitLocker has a back door. You cannot examine the source code to find out, either. (And even if you could, a purposeful weakness might be very difficult to spot, even for an experienced cryptographer.) TrueCrypt's source code is available and has (as of today) been audited. No back doors or ...


3

With my bug bounty experience, I would suggest certain things that would help and make the task easy: 1) If the website you are testing has any sub domains, please go for those first as the main website domain is the first which is tried by many. 2) Do not use automated tools as many of the results are false positives and those bugs have high probability ...


2

If they keep coming back, it means that you have some software running checks on them. You should take some tool to analyze the running processes on your machine. Use Process Explorer to look at the current running processes (so that you can find out which one is recreating the reported keys and Autoruns to check the list of programs initiated ...


2

ANSI stands for American National Standards Institute ISO stands for International Organization for Standardization ANSI is the American representative of the ISO body. So, yes, ISO is the umbrella, but in the US, ANSI is the representative.


2

Of the ISO 27000 range of documents, only 27001 is a certifiable standard. The others in the range are guidance and advisory documents. The first step of ISO 27001 implementation is defining the scope. In my experience it would be unusual to have "IT Processes" as a scope - it's usually defined by business area. So for example the Operations part of the ...



Top 50 recent answers are included