Hot answers tagged

34

As pointed out by begueradj, any government agencies can access your cloud-stored files through a subpoena to Google. But your question was what they can do when they have your laptop alone and nothing else. This is not an unlikely scenario. It is the situation you have, for example, when you get arrested by law enforcement and they do not have sufficient ...


11

Document-based exploits are directed not at the document itself, but rather at some vulnerability in the viewer. If you view the document in a program that isn't vulnerable (or in a configuration that inhibits the vulnerability), then you won't be exploited. The real issue is knowing whether or not your viewer is vulnerable, which usually means knowing ...


10

If I am attacking a network, having a map helps me target my attack, avoiding possible sensors, honeypots etc and aiming at high value targets or sources of information. This can speed up an attack immensely, reducing the defender's chance of preventing it. In summary, yes this is a security risk! Update: To reduce risk, some steps you can take are: ...


8

Security by obscurity isn't security and so, in theory, knowledge of the network shouldn't make a difference, but being that there are often known issues and that being able to avoid traps helps avoid detection, it is important to ensure that the map is not identifiable or discoverable to a would be attacker of your infrastructure. That said, there is also ...


7

Put it through a PDF viewer that isn't vulnerable to the exploit. If it's someone else's viewer, that's even safer. Try Google Docs, where they will parse it and display it as HTML, so the malicious payload won't harm you. (I'm sure that their PDF parser is extremely secure, so you shouldn't feel bad about possibly infecting them.)


6

In addition to the answers discussing cloud access, or the good answer from phillip, google docs is going to leave lots of traces in temp files/swap etc where the documents could be easily retrieved. By common practice/configuration virtually all browsers are going to leave temp files behind for every page viewed. In addition to the temp/cache files that ...


4

Use a virtual machine that can be reverted to clean slate after tests. If the PDF reader is vulnerable, your real workstation will be much less likely to be affected.


4

In this situation I've always used the Unix/Linux/OSX shell command "strings". On *nix systems, do this: strings ScaryFile.pdf | less You can also get "strings" for Windows, as mentioned by Polynomial, below. You can download it here. Runs on XP or higher. Here is an example of using it on Windows: strings ScaryFile | findstr /i TextToSearchFor But ...


4

While there is probably some risk in exposing your network diagram to outsiders, I will asssert strongly that there is enourmous risk is concealing your network diagram from insiders. Usually when I see the security through obscurity policy implemented it has a far larger impact on legitimate insiders than outsiders. An outsider can firewalk your network ...


4

Others have commented that if they capture your session cookie they can simply access your documents, and otherwise they can obtain a warrant to get your documents from Google. There is a minor twist to the second point: they need to know your user ID. Without this, they cannot serve a meaningful warrant to Google, and finding some incriminating document ...


3

A document signing service does not process the data contained within the document it is signing. Theoretically, the signing service is completely unaware of the content. All it does is process the metadata as a whole in order to provide service. From this perspective, the fact that a certain document contains PII is not within their control, and therefore ...


3

One approach is to lock down endpoints to block the egress points, which includes: Disabling local media: USB, SD cards, CD writers, firewire, etc. Many enterprises attempt this - disabling USB is considered a standard baseline - but rarely are all these blocked. Thin clients can do this more robustly than a normal computer. Blocking network egress: this ...


3

Ticketing platforms are normally used for this kind of thing. Many products that perform asset management also include a ticking function: Spiceworks Footprints Netclarity Tracking information is important, but so is tracking everyone's activity, relating incidents, and ensuring that incidents are closed and handled properly. For that level of ...


2

If you are more on the "techy" side some of the following will help you manage security tool data: Dradis: A really cool tool for taking notes and organizing data during a pen test. They also offer professional version and support. Open Source Security Assessment Management System: A tool to manage input from multiple security tools, still in early alpha / ...


2

Elder relatives are very susceptible to this kind of fraud: A person digs through paper in a dumpster. They find out papers which hold personal information. Even a little bit sometimes is enough, e. g. name of employer, bank, school etc. When they have enough, they identify means of contacting relatives of the person whose information they have just ...


2

Shredding this information should provide some minimal protection against identity theft, and would be a good idea. However, people can still usually find this information (e.g. online, or in a phone book), so the protection gained from shredding this information is limited. However, there is usually other information attached to the document which could ...


2

Any documentation software will work just fine, even a bare web page can do what you hope a wiki could. But, there is one aspect that you need to keep in mind: an authoritative version. Having a wiki means interative versioning, but that's also its weakness. How can the organization have faith that in the middle of a disaster that they are using the tested, ...


2

Note, I work for DocuSign. The answers by Lie Ryan and schroeder are focused on the "pure" aspects of a signing service, which is responsible for just signing, in the narrow sense. However, signing services can offer a broader product that includes additional services. For example, my company, DocuSign, offers the "Concealed View" feature. See the Quick ...


2

It's really a bad idea to store sensitive information in the internet, especially in Google products. If you are concerned about FBI I suggest to delete everything and read a lot about how to keep your files safe. If you need thease files in internet for some reason, at least use PGP encryption for the files. Also use encryption for your hard drive with ...


1

You can generate your own certificate. The certificate is then used to digitally sign data, including signing a PDF. This type of certificate is a "self-signed" certificate. Documents signed with a self-signed certificate are usually regarded with mistrust since there is no inherent trust relationship between the signer's certificate and the relying party (...


1

As you've already surmised, the only thing you can do is to prevent the camera from working at all. Unfortunately, tiny camera's are prevalent everywhere now so completely preventing this issue is pretty well impossible without taking very extreme actions.


1

Yes a Word doc can contain a virus. Rename the DOCX to zip and you can open it with WinZip or another tool. This will expose all OLE embedded data, however it's possible that the individual files in that Winzip are virus vectors (JPG, etc)


1

Corporate technologies to do that include Data Loss Prevention (DLP) for example. But scanning for "hot files" that are not even written on disk, there's a 0.01% chance your employer will log and review it.


1

Read The Contract. You didn't say whether you are the vendor or the buyer. If the contract wasn't drafted well enough to protect you, fire your lawyer. (For legal advice consult a licensed attorney.) I don't see how any complete DR plan can possibly be written without knowledge of the infrastructure, operating environment, etc. If you find yourself in a ...


1

Check out the guidance from the German scheme, on page 83 of the following document: http://www.commoncriteriaportal.org/files/ccfiles/CommonCriteriaDevelopersGuide_1_0.pdf


1

Lets not shave a yak. It sounds as though you want to understand and get into fuzzing. Sulley and Peach are fuzzers that have extensive capabilities that should help you. Also, writing your own fuzzer should help understanding the actual fuzzing process. Here is a resource for a bunch of different fuzzers. Ultimately, common sense aids in the fuzzing ...


1

I haven't seen such a document before. FIM uses security groups for controlling access to the synchronisation engine and sets for the FIM service. My suggestion is to use AD security groups for the synchronisation engine that way you can utilize AD auditing to monitor the security groups. By default the FIM service uses a least privilege approach and you ...


1

One piece of advice form the ISO 27001 world, that might be relevant, is that if your organisation already has ISO 9001 or ISO 14001 or similar, look at what those teams are using for document management etc. and use the same thing - they will already have solved many of the problems. Even if your organisation is not running any ISO management systems, ...


1

Could you not use the IT ticketing system and use permissions to implement your requirements of exclusivity to the IS team?



Only top voted, non community-wiki answers of a minimum length are eligible