Tag Info

Hot answers tagged

10

If I am attacking a network, having a map helps me target my attack, avoiding possible sensors, honeypots etc and aiming at high value targets or sources of information. This can speed up an attack immensely, reducing the defender's chance of preventing it. In summary, yes this is a security risk! Update: To reduce risk, some steps you can take are: ...


7

Security by obscurity isn't security and so, in theory, knowledge of the network shouldn't make a difference, but being that there are often known issues and that being able to avoid traps helps avoid detection, it is important to ensure that the map is not identifiable or discoverable to a would be attacker of your infrastructure. That said, there is also ...


7

Document-based exploits are directed not at the document itself, but rather at some vulnerability in the viewer. If you view the document in a program that isn't vulnerable (or in a configuration that inhibits the vulnerability), then you won't be exploited. The real issue is knowing whether or not your viewer is vulnerable, which usually means knowing ...


5

According to the Microsoft whitepaper and a few other MSDN blog sources, the following specs are defined: Key derivation is performed using 50,000 iterations[source] of SHA-1 (increased to 100k in SP2). Uses a 16-byte (128-bit) random salt. AES is the block cipher used to encrypt the document. By default, 128-bit key are used. There is a registry tweak to ...


5

Put it through a PDF viewer that isn't vulnerable to the exploit. If it's someone else's viewer, that's even safer. Try Google Docs, where they will parse it and display it as HTML, so the malicious payload won't harm you. (I'm sure that their PDF parser is extremely secure, so you shouldn't feel bad about possibly infecting them.)


3

While there is probably some risk in exposing your network diagram to outsiders, I will asssert strongly that there is enourmous risk is concealing your network diagram from insiders. Usually when I see the security through obscurity policy implemented it has a far larger impact on legitimate insiders than outsiders. An outsider can firewalk your network ...


3

One approach is to lock down endpoints to block the egress points, which includes: Disabling local media: USB, SD cards, CD writers, firewire, etc. Many enterprises attempt this - disabling USB is considered a standard baseline - but rarely are all these blocked. Thin clients can do this more robustly than a normal computer. Blocking network egress: this ...


3

Use a virtual machine that can be reverted to clean slate after tests. If the PDF reader is vulnerable, your real workstation will be much less likely to be affected.


3

In this situation I've always used the Unix/Linux/OSX shell command "strings". On *nix systems, do this: strings ScaryFile.pdf | less You can also get "strings" for Windows, as mentioned by Polynomial, below. You can download it here. Runs on XP or higher. Here is an example of using it on Windows: strings ScaryFile | findstr /i TextToSearchFor But ...


3

Ticketing platforms are normally used for this kind of thing. Many products that perform asset management also include a ticking function: Spiceworks Footprints Netclarity Tracking information is important, but so is tracking everyone's activity, relating incidents, and ensuring that incidents are closed and handled properly. For that level of ...


2

If you are more on the "techy" side some of the following will help you manage security tool data: Dradis: A really cool tool for taking notes and organizing data during a pen test. They also offer professional version and support. Open Source Security Assessment Management System: A tool to manage input from multiple security tools, still in early alpha / ...


1

Shredding this information should provide some minimal protection against identity theft, and would be a good idea. However, people can still usually find this information (e.g. online, or in a phone book), so the protection gained from shredding this information is limited. However, there is usually other information attached to the document which could ...


1

Yes a Word doc can contain a virus. Rename the DOCX to zip and you can open it with WinZip or another tool. This will expose all OLE embedded data, however it's possible that the individual files in that Winzip are virus vectors (JPG, etc)


1

Corporate technologies to do that include Data Loss Prevention (DLP) for example. But scanning for "hot files" that are not even written on disk, there's a 0.01% chance your employer will log and review it.


1

Read The Contract. You didn't say whether you are the vendor or the buyer. If the contract wasn't drafted well enough to protect you, fire your lawyer. (For legal advice consult a licensed attorney.) I don't see how any complete DR plan can possibly be written without knowledge of the infrastructure, operating environment, etc. If you find yourself in a ...


1

I haven't seen such a document before. FIM uses security groups for controlling access to the synchronisation engine and sets for the FIM service. My suggestion is to use AD security groups for the synchronisation engine that way you can utilize AD auditing to monitor the security groups. By default the FIM service uses a least privilege approach and you ...


1

One piece of advice form the ISO 27001 world, that might be relevant, is that if your organisation already has ISO 9001 or ISO 14001 or similar, look at what those teams are using for document management etc. and use the same thing - they will already have solved many of the problems. Even if your organisation is not running any ISO management systems, ...


1

Could you not use the IT ticketing system and use permissions to implement your requirements of exclusivity to the IS team?


1

Use pdf.js [1] with a sandboxed browser (such as Chromium) in a virtual machine without network access. [1] http://mozilla.github.com/pdf.js/web/viewer.html It should be quite tricky for a malware to get out of this.



Only top voted, non community-wiki answers of a minimum length are eligible