Tag Info

New answers tagged

41

What are the strengths of each team member that I will work with regularly? (i.e. programming, linux, networking, regulations, etc.) Where is our documentation? You hopefully have a wiki, a knowledge base, or set of documents somewhere that explain your processes and policies. If you don't, be a hero and get started on one. What are the current projects the ...


1

Regular expressions are of very limited use here as any attack delivered via a HTTP POST request is unlikely to get logged. There are also many examples of header values having an impact while not being logged, ie: shellshock. There will also be alot of noise from automated scanners like Nikto that have no impact unless the visited url exist and is ...


0

PCI DSS PAN Data (Personal Account Number) should following these principals when storing: Encrypt PAN number upon creation in database (typically with HSM device) Only decrypt PAN number when billing action occurs (reoccurring billing, use stored number to buy an item, etc.) Store, in separate column (or preferably separate dB) only last 4-digits of PAN, ...


0

I think you have a good approach. I find it interesting that users would complain about not being able to immediately identify card numbers when they can view the first six AND last four in your results table--it is unlikely that there would be two results with the same masked number. The way you currently have it implemented is good because it has very ...


1

If you use Firefox, you can install Firebug, go to the Network tab, and load your site. All the requests will be shown there, so you can host them on your server and change the code for your website.


5

The best solution would be to implicitly deny, i.e. allow exactly the data you want, but no other. You could write regexps matching all input that's not according to your filter to find any odd input, that might be an exploit. It is also a good way to find valid input you omitted in your regex. A username might be fine with [a-zA-Z0-9]+, rather than ...


1

Don't write directly the files! Use a logging service (or in the case of the Apache error_log just print into the stderr). And make sure that the logs are outside the document root - if the webserver can be fooled into serving them up as PHP files then you have a major code injection vulnerability. if the log file is subsequently opened/read via command ...


1

Yes. This data should be useful to help debug errors, however, there are at least a few (maybe more) potential security pitfalls to consider: Is any of the data privacy sensitive (like social security numbers, passwords, addresses, etc...?) If so, there could be privacy concerns, but those most of those concerns should already exist with the website ...


4

Keeping complete traffic information and giving it to customers is expensive for ISP, and there is not a lot of money to do out of embarrassing teenagers (understandably, the teenagers won't pay for it; but their parents won't pay either for obtaining that information, their offspring being already quite expensive to maintain). Consequence is that ISP don't ...


4

Many ISP's log DNS requests, so could have a record of what sites you have browsed to. This is mostly for law enforcement requirements, not generally for giving back to customers, as they should be expected to do their own logging if they want it. That said - if you are concerned, have you checked to see if your mother is logging all DNS requests? Your ...



Top 50 recent answers are included