Tag Info

Hot answers tagged

52

When you store data on Google Docs, as you may already know, it is not encrypted at all. I read that everything you upload to Google Docs and similar services are not only yours anymore because you agree Google to own them too. This means, at first glance, Google has already access to your files since Google confesses that by itself: When you upload, ...


33

As pointed out by begueradj, any government agencies can access your cloud-stored files through a subpoena to Google. But your question was what they can do when they have your laptop alone and nothing else. This is not an unlikely scenario. It is the situation you have, for example, when you get arrested by law enforcement and they do not have sufficient ...


10

If I am attacking a network, having a map helps me target my attack, avoiding possible sensors, honeypots etc and aiming at high value targets or sources of information. This can speed up an attack immensely, reducing the defender's chance of preventing it. In summary, yes this is a security risk! Update: To reduce risk, some steps you can take are: ...


8

Security by obscurity isn't security and so, in theory, knowledge of the network shouldn't make a difference, but being that there are often known issues and that being able to avoid traps helps avoid detection, it is important to ensure that the map is not identifiable or discoverable to a would be attacker of your infrastructure. That said, there is also ...


7

Document-based exploits are directed not at the document itself, but rather at some vulnerability in the viewer. If you view the document in a program that isn't vulnerable (or in a configuration that inhibits the vulnerability), then you won't be exploited. The real issue is knowing whether or not your viewer is vulnerable, which usually means knowing ...


6

According to the Microsoft whitepaper and a few other MSDN blog sources, the following specs are defined: Key derivation is performed using 50,000 iterations[source] of SHA-1 (increased to 100k in SP2). Uses a 16-byte (128-bit) random salt. AES is the block cipher used to encrypt the document. By default, 128-bit key are used. There is a registry tweak to ...


6

Put it through a PDF viewer that isn't vulnerable to the exploit. If it's someone else's viewer, that's even safer. Try Google Docs, where they will parse it and display it as HTML, so the malicious payload won't harm you. (I'm sure that their PDF parser is extremely secure, so you shouldn't feel bad about possibly infecting them.)


5

In addition to the answers discussing cloud access, or the good answer from phillip, google docs is going to leave lots of traces in temp files/swap etc where the documents could be easily retrieved. By common practice/configuration virtually all browsers are going to leave temp files behind for every page viewed. In addition to the temp/cache files that ...


4

Others have commented that if they capture your session cookie they can simply access your documents, and otherwise they can obtain a warrant to get your documents from Google. There is a minor twist to the second point: they need to know your user ID. Without this, they cannot serve a meaningful warrant to Google, and finding some incriminating document ...


4

While there is probably some risk in exposing your network diagram to outsiders, I will asssert strongly that there is enourmous risk is concealing your network diagram from insiders. Usually when I see the security through obscurity policy implemented it has a far larger impact on legitimate insiders than outsiders. An outsider can firewalk your network ...


3

It's really a bad idea to store sensitive information in the internet, especially in Google products. If you are concerned about FBI I suggest to delete everything and read a lot about how to keep your files safe. If you need thease files in internet for some reason, at least use PGP encryption for the files. Also use encryption for your hard drive with ...


3

One approach is to lock down endpoints to block the egress points, which includes: Disabling local media: USB, SD cards, CD writers, firewire, etc. Many enterprises attempt this - disabling USB is considered a standard baseline - but rarely are all these blocked. Thin clients can do this more robustly than a normal computer. Blocking network egress: this ...


3

Use a virtual machine that can be reverted to clean slate after tests. If the PDF reader is vulnerable, your real workstation will be much less likely to be affected.


3

In this situation I've always used the Unix/Linux/OSX shell command "strings". On *nix systems, do this: strings ScaryFile.pdf | less You can also get "strings" for Windows, as mentioned by Polynomial, below. You can download it here. Runs on XP or higher. Here is an example of using it on Windows: strings ScaryFile | findstr /i TextToSearchFor But ...


3

Ticketing platforms are normally used for this kind of thing. Many products that perform asset management also include a ticking function: Spiceworks Footprints Netclarity Tracking information is important, but so is tracking everyone's activity, relating incidents, and ensuring that incidents are closed and handled properly. For that level of ...


2

If you are more on the "techy" side some of the following will help you manage security tool data: Dradis: A really cool tool for taking notes and organizing data during a pen test. They also offer professional version and support. Open Source Security Assessment Management System: A tool to manage input from multiple security tools, still in early alpha / ...


2

Shredding this information should provide some minimal protection against identity theft, and would be a good idea. However, people can still usually find this information (e.g. online, or in a phone book), so the protection gained from shredding this information is limited. However, there is usually other information attached to the document which could ...


2

This question verges upon opinion-based, but I'll try and provide some suggestions based on my experience (which is biased towards PCI but touches on others). It isn't specific to the cloud but I believe there's an equivalence. Some rules of thumb: Attestations / summaries are distributed, reports are generally not Policies are more likely shared than ...


2

Any documentation software will work just fine, even a bare web page can do what you hope a wiki could. But, there is one aspect that you need to keep in mind: an authoritative version. Having a wiki means interative versioning, but that's also its weakness. How can the organization have faith that in the middle of a disaster that they are using the tested, ...


1

More Dates Data ... svchost.exe when it tried to access DataDefinitions at Norton's install folder. It seems a very clear activity of a trojan, doesn't it? svchost is a process which is used for lots of different things. So it might be an infection or it might be not. And it is not even clear that the infection happened only after Norton got installed. ...


1

As you've already surmised, the only thing you can do is to prevent the camera from working at all. Unfortunately, tiny camera's are prevalent everywhere now so completely preventing this issue is pretty well impossible without taking very extreme actions.


1

Elder relatives are very susceptible to this kind of fraud: A person digs through paper in a dumpster. They find out papers which hold personal information. Even a little bit sometimes is enough, e. g. name of employer, bank, school etc. When they have enough, they identify means of contacting relatives of the person whose information they have just ...


1

Yes a Word doc can contain a virus. Rename the DOCX to zip and you can open it with WinZip or another tool. This will expose all OLE embedded data, however it's possible that the individual files in that Winzip are virus vectors (JPG, etc)


1

Corporate technologies to do that include Data Loss Prevention (DLP) for example. But scanning for "hot files" that are not even written on disk, there's a 0.01% chance your employer will log and review it.


1

Read The Contract. You didn't say whether you are the vendor or the buyer. If the contract wasn't drafted well enough to protect you, fire your lawyer. (For legal advice consult a licensed attorney.) I don't see how any complete DR plan can possibly be written without knowledge of the infrastructure, operating environment, etc. If you find yourself in a ...


1

I haven't seen such a document before. FIM uses security groups for controlling access to the synchronisation engine and sets for the FIM service. My suggestion is to use AD security groups for the synchronisation engine that way you can utilize AD auditing to monitor the security groups. By default the FIM service uses a least privilege approach and you ...


1

One piece of advice form the ISO 27001 world, that might be relevant, is that if your organisation already has ISO 9001 or ISO 14001 or similar, look at what those teams are using for document management etc. and use the same thing - they will already have solved many of the problems. Even if your organisation is not running any ISO management systems, ...


1

Could you not use the IT ticketing system and use permissions to implement your requirements of exclusivity to the IS team?


1

Use pdf.js [1] with a sandboxed browser (such as Chromium) in a virtual machine without network access. [1] http://mozilla.github.com/pdf.js/web/viewer.html It should be quite tricky for a malware to get out of this.



Only top voted, non community-wiki answers of a minimum length are eligible