Hot answers tagged

12

Amazon claims that AWS VPC is "logically isolated" from the other AWS instances, and from the Internet. "Logically" means that it is done in software, not with dedicated hardware system. An AWS VPC can be connected to your VPN and it will use IPsec for that external connection, but this does not mean that internally IPsec is used. In fact, how the "isolation"...


7

Yes, they can theoretically access or monitor the data. No, this should not be a concern. Their incentives (organizationally and individually) to provide a stable, secure service are certainly greater than their incentives to steal your application's data, out of all of the millions of virtual machines and applications that they manage the infrastructure ...


4

Law enforcement do not care about your uptime. Law enforcement do not care about your losses. They want to preserve chain of custody and integrity of evidence. If your gear is seized as part of a raid, they'll take your whole machine. If you want to prosecute someone for breaking into your box, they'll demand a provably identical image of the drive, obtained ...


3

If you are giving them both the thing to be protected and the means to access it, no, the encrypted disk is still vulnerable. Typically you would handle this through separation of duties. The person who has physical access to the machines would not also be given logon rights to the machines, nor would he be given access to any of the decryption keys. For ...


2

It all depends on your security model, but as Google recently found out, even if you own the link between your servers, you still can't assume that it's secure. The idea of hardening the edge of your network with appropriate protection and then playing "anything goes" with the internals is a popular tactic, but one which has significant, disastrous security ...


2

I think the first thing you should document, in your case, is your threat model. That is, what threats are you defending against, what risks are you worried about, what your security profile is, etc. Since you don't need big Corporate Documentation, this way would be a lot easier, to then document the mapping between the threats/risks, and the mitigation ...


2

If it was me I would create a spreadsheet with 2 columns in it with the first one defining the piece of security Ex. •Keypad/Security door •CCTV •Strong Firewall and in the second column back up why the items listed in the first column are considered secure. For example CCTV | The CCTV system records footage locally and also sends real time alerts to X ...


2

You will want to make sure that all associated vendors have either a SAS70 type 2 or SSAE16 that is up to date. This should provide you with a list of the physical and technical security controls in place, and their effectiveness.


1

What is the right way to prevent outgoing attacks since most firewalls only offer protection for incoming attacks? To throttle or drop traffic burst I've tried different modules in iptables. The best of which was hashlimit module. I use it in FORWARD chain. For example, to prevent outgoing TCP SYN traffic burst and limit it to 60 request a minutes use: ...


1

Given that your warehouse contains additional data that you don't want to expose a new attack vector to it sounds like your best option is to implement some kind of basic caching layer for this data on the web server that the warehouse can push to. You'd have some kind of service running in your secure warehouse environment pushing a serialized ...



Only top voted, non community-wiki answers of a minimum length are eligible