Tag Info

New answers tagged

1

There is a polish platform: rozwal.to. The name in english means "destroy.it". There is about 50 tasks which vary with needed skill level and the subject (XSS, Injections, SQLi, Steganogrpahy, bitcoins etc.). The big advantage is that you don't need to install anything, you just simply open pages and hack them. It has also a ranking so you can compare ...


5

I've been trying to maintain a list of useful resources for Security Enthusiasts on my personal website. Here's a part of it: Web Application Security Browser Security Handbook - By Michal Zalewski Google Gruyere - Web Application Exploits and Defenses - a small, cheesy web application that allows its users to publish snippets of text and store assorted ...


12

These are all that i recommend. Web Vulnerability 1. Webgoat(Recommend) - https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project 2. EnigmaGroup(WarGame) - http://www.enigmagroup.org 3. Mutillidae(Good) http://sourceforge.net/projects/mutillidae/ 4. DVWA (not so good) http://www.dvwa.co.uk/ OS Vulnerability 5. Metasploitable(Recommend) - ...


2

You can find platforms that provide so-called wargames, such as OverTheWire. In such games, you have an SSH access to a public machine with custom vulnerable software that you must exploit in order to progress further.


19

Depending on what you call "online", a simple Google search on "damn vulnerable" will reveal the existence of freely downloadable applications of even full OS, meant for, indeed, learning all the ways software can be horribly vulnerable. One of them is Damn Vulnerable Web App, which is, you guessed it, a damn vulnerable Web app. There also used to be a full ...


1

Technically: Solid understanding of CAN-bus (most important IMHO), and maybe LIN bus - error handling, isolation techniques, message structure, HLPs. Working knowledge of ECU, sensor electronics and control modules Advanced reverse engineering skills (sniffing, protocol analysis, cryptography)


3

Virtually all new connected cars have IT security issues. First of all, when we talk about connected cars, we refer to wireless connection. So having a good knowledge of how 802.1 protocol list and technologies such as LAN function is a must. Also there is a wide range of software that connected cars may use, including operating systems such as Microsoft ...


0

Data security policy should be introduced conceptually to the employee before they sign the contract, and explained and/or provided to them in detail before they sit down at their desk for the first time.


3

First, when the employee starts. Not in order for them to learn a lot, but to get the impression that you are taking security seriously, so they don't do anything stupid. Then a week or two later, when the employee has some clue about the job they are doing, and can actually appreciate the security training. Then a while later when they are firmly and ...


1

'Stay aware and alert' is the mantra for information security. As for your question, the awareness should be part of the induction program for new employees. Basic security etiquettes like Not flashing ID cards No scribbling of sensitive information. Governing policies like web access restrictions etc. These are basic policies that need to be put forth ...


36

The question could also be asked: "how long should an employee have access to data before they are trained in how to use and protect that data?" For most organizations, the answer is "0 minutes". You wouldn't place an employee in front of machinery without training them, and you shouldn't place employees in front of a computer without training either. Each ...


16

Do it as part of new employee orientation and follow up with more training at regular intervals. Security policy is part of our new employee orientation. We also require a short online "securing the human" training to be completed once every other year. Introduction of this regular training has had noticable positive results.


1

The obvious answer here is that experience is the only thing that matter. Reverse engineer tons of stuff. Expand your knowledge. Share what you've learned. Etc etc. But of course, getting a certification won't do you any harm and as far as I am concerned, will only count as a plus on your CV. However; having a certification on your CV doesn't get you a job ...


0

The certifications you need are the ones your employer is looking for. There is no better gauge than that. As for when you you get them: you get them when you deserve them. When you are ready to write, you write, and not before. To cram for an exam and memorize answers, you do yourself a disservice. Certs are one way to show your experience after you have ...



Top 50 recent answers are included