Hot answers tagged

71

Physical destruction of a drive is tricky business. There are many companies that deal specifically in the field of data destruction, so if you are doing any kind of mass you may want to at least look at their price list. If you contract, make sure the company is properly bonded/insured, and provides audit trails for each destroyed item. In the worst case ...


65

Summary: it was marginally better on older drives, but doesn't matter now. Multiple passes erase a tree with overkill but miss the rest of the forest. Use encryption. The origin lies in work by Peter Gutmann, who showed that there is some memory in a disk bit: a zero that's been overwritten with a zero can be distinguished from a one that's been overwritten ...


45

Very good question. Yes, by default, WinRAR leaves traces of temporarily extracted files. WinRAR does indeed create temporary files when opening them directly from the archive. It also performs a normal deletion once WinRAR is closed. However, deleted files do physically stay on the disk after you delete them. Normal delete operations only delete the file ...


36

The question could also be asked: "how long should an employee have access to data before they are trained in how to use and protect that data?" For most organizations, the answer is "0 minutes". You wouldn't place an employee in front of machinery without training them, and you shouldn't place employees in front of a computer without training either. Each ...


31

The only NIST approved method to securely erase a hard drive is by utilizing the secure erase internal command - documented at the Center for Magnetic Recording Research (CMRR) - and that is what everyone should be doing. It is an ATA command, and covers (S)ATA interfaces. After that, you can optionally degauss the drive to erase the firmware itself. Lots ...


30

There is mainly two kind of people to consider in this question: The person working on the computer. This person is your employee, they went through your HR screening and abides by your policies. They have been trusted to access and work with some data. Due to this, since they need to see, no technical measure can prevent them from taking photographs ...


30

Here is what I do... I assume my data is out there... I don't bother looking for it. Somebody will run across my SSN eventually and it will get scraped up into a database and sold around the world. As far as I'm concerned, searching for my data has little value and certainly won't put the horse back into the barn. In fact, even searching for my SSN or ...


29

You do get some security from the way your fuse box is connected to the mains. In principle you should get a good signal across any part of the wiring in your house that is on the same phase, and you shouldn't get any on the other phases. In reality though, that isn't quite true - depending on your fuse box, you may get some bleed over onto the other ...


27

Assuming that You're 100% sure that your database server only accepts local connections. You're 100% sure that the attacker doesn't have access to the local environment from which connections are allowed. You're 100% sure that the application that uses the database is otherwise secure. You're 100% sure that those credentials aren't used for anything else ...


25

It really depends upon the specific threats you may be facing, the direction of your data transfers, etc. USB specific dangers You mention the dangers of USB. The main one is indeed related to its firmware opening the possibility of a BadUSB type attack. When you need to transfer data in both directions, you may therefore prefer to use SD-Cards which are ...


24

First of all, you should make sure that you don't use that password, or a derivative, anywhere that you care about. This is most important if you use the same username or email address, but still something that you should do for completely unrelated accounts. If a password is crackable, it may have been incorporated into wordlists already. And even if not, ...


22

I live in a detached family home in Texas. I have a pair of Trendnet TPL-303E powerline adapters and have experienced the signal bleed from my next door neighbor. I ran the Powerline utility that came with the adapters and could identify two other powerline adapters using the same network name. I got anywhere between 10 to 20Mbps of throughput between their ...


20

Use SSL Make sure you implement session management correctly - for example the presence of correct session id checked on each page and destroyed with logout Add cache control: no-cache, pragma: no-cache and expire: -1 headers everywhere Make sure that forms and every sensitive variable are submitted only through POST requests and not GET (during code audits ...


20

What's the point of stealing hashed passwords? Let's say I steal a hashed password, I can take a random string, hash it, and see if the hashes match. If they do then I've just cracked your password. For example, assume that under some hash function we get the following hash table: "cat" --> AA "dog" --> AB "elephant" --> AC ... If I steal a ...


18

From a theoretical standpoint the idea of total drive destruction may be the only way of destroying data on a hard drive fully. From a practical standpoint, I've not seen any evidence that it's possible to recover meaningful data from a standard hard drive (ie, not taking SSDs or other devices that use wear levelling or similar technologies) after a once ...


18

I think it's fair to say that the idea that any large organisation is entirely impervious to attack has been proven false over the last five years or so. Everyone from nation states through large corporations, security consultancies and other security minded companies have had breaches. One reason that a bank hasn't been thrown into "complete chaos" as you ...


17

The underlying idea of the comic is that separation of user accounts has been designed for mainframes: big computers, shared by many users. In that model, the potential attackers are other users. Account separation is then about protecting users from other users; only the god-like admin account can access everything on the machine, and the administrator has ...


17

It is not reasonable to ever assume data you receive (including your operating system, BTW) from an outside source can be made 100% secure. The most secure way to transfer something and all-but-guarantee no side-effects (e.g. the OS mounting an external drive) is to type in all the data by hand while you be sure you understand it all. Even then you still ...


16

There is an element of truth to this one - an attack was discovered which took advantage of data remanence in RAM, allowing an attacker to grab data from the RAM in a machine. There was a very short timeframe (a matter of seconds or minutes) in which to do this, but it wasn't a hack of the PC as such. Simple Wikipedia link to Cold Boot Attack here And the ...


16

Do it as part of new employee orientation and follow up with more training at regular intervals. Security policy is part of our new employee orientation. We also require a short online "securing the human" training to be completed once every other year. Introduction of this regular training has had noticable positive results.


15

You want fast and simple? Step 1: Try and take it apart. If you have the right screwdrivers, great, if not, just go to the next step. EDIT2: Also use sandpaper on the platters before smashing them. It's very hard to smash into small enough pieces, and very hard to sand afterwards. If you can spend a bit of money, there are also dedicated kits, such as ...


14

In my view, unfortunately the answer is: unless you're willing to go with the two pretty radical options I mention below, probably not with any kind of really strong guarantee of security. Other answerers have suggested technical measures that, in theory, might possibly allow users to see information on screens properly while preventing cameras from doing ...


14

Call the bank and cancel the card. It's the only way to prevent it from being used, since any merchant with whom you've previously used the card, or anyone who otherwise already has the card data (including simply a photograph of the card) could theoretically run it in a card-not-present transaction. Once you cancel the card, the physical plastic card is ...


14

If he can't access the database, the credentials are meaningless. It's like having a key to a door that's inside a guarded military bunker hidden in a remote location in the Gobi desert. The key is only useful if you can get to the door. That being said, it'd be very bad practice to let your credentials leak out like this. If you suspect that they're ...


13

I realize that this isn't what you're asking, but it's important enough that I decided to write it anyway: If security is important to you, then you should, as a rule, assume that ALL networks are insecure. (because in the end, they all are) Many of the more expensive network security disasters in IT have come from the assumption that "behind the firewall" ...


13

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements, Ahhh assumptions.. Have you seen the OWASP Top Ten project? SQL injections have always been a constant source of security issues. I cannot see how changing any session state would effect the ...


12

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase data changes also. Very smart people have expended enormous amounts of time and effort arguing over this problem. Most of them end up at the same bottom line, which is: the only method you can truly trust is ...


12

There is a well-known reference article by Peter Gutmann on the subject. However, that article is a bit old (15 years) and newer harddisks might not operate as is described. Some data may fail to be totally obliterated by a single write due to two phenomena: We want to write a bit (0 or 1) but the physical signal is analog. Data is stored by manipulating ...


12

From what I can see this appears to be an aggregator for financial services. For it to have any useful function, that implies it must, at least temporarily, store your account details and authentication credentials - in which case it is far from "read-only". That the providers then state the exact opposite in the security statement makes me think these are ...


12

So I just signed up with mint.com and think a combination of Ramhound and this.josh's answers are correct. For well-supported banks (e.g., I tried ING direct), when you add your account to mint.com you typically give out your account number, plus an "access code" that isn't your typical password. An access code allows financial management tools like ...



Only top voted, non community-wiki answers of a minimum length are eligible