Tag Info

Hot answers tagged

51

Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at length about this issue. In brief, there's insufficient research. In long, here are some of his ideas for less painful account locking: Don't count duplicate password attempts (they probably thought they mistyped it) Make the password hint about the ...


29

Any website that complies with PCI Data Security Standards has to adhere to sections 8.5.13 (Limit repeated access attempts by locking out the user ID after not more than six attempts) 8.5.14 (Set the lockout duration to thirty minutes or until administrator enables the user ID). This is unfortunately why a lot of sites accepting credit cards have ...


24

Paranoia, professional skepticism, risk management... sometimes these concept are hard to separate. The odds that somebody is reading my packets right at this moment are relatively low. The odds that somebody has sniffed my internet traffic at some point in the past year... I guarantee it has happened, I've been to DEFCON. The advent of wireless networking ...


19

I see two sides on this: most government bodies I review/audit tend to believe that because they secure everything then they are the most secure and that is the way it should be! In actuality the organisations that go down the security nazi route usually end up more open than those who are pragmatic about it. For example, locking down your users too hard ...


18

My experience is lock out mechanisms are diminishing in popularity (at least for web apps). Instead of locking accounts out after a series of failed attempts, you begin to ask for additional information for successful authentication.


15

Yes, I think it's possible to be too paranoid. Although, also, I just finished talking security with a bunch of performing artists - people with no money who really need to spend their time promoting their work and creating new work... not building the Fort Knox of security just so they can use Facebook. They need common sense, a basic understanding of ...


13

Wouldn't be surprised if it came from the baseball "Three strikes" rule rather than anything technical. One justification (for alphanumerics passwords anyway) is Typically a failed attempt is either a mis-type or a CAPS on/off issue. So you try to log on and get rejected (1), try again because you think you mis-typed (2) and then realize the CAPS key is ...


12

The short answer is this: No, CentOS 5.6 is inherently no more or less secure than any other modern supported operating system. The long answer is a bit more complicated. CentOS is the "Community" release of RedHat Enterprise Linux (RHEL). The differences between the two are fairly small so you can think of them as functionally equivalent, see the Wikipedia ...


12

I agree with the OP. If you think about what the lockout protects you against, there is no difference between 3 or 20 attempts (or 100, for that matter). All you achieve with these lockouts, apart from punishing forgetful users, is to prevent a brute-force attack. You can also user it to trigger a warning that an attack is on-going, but that isn't the ...


11

This is such an astonishing question that I find it difficult to answer. This distrust doesn't come from theory, but from experience. When we say "FTP is too dangerous to use" is because we've found it, in practice, too dangerous to use. You seem to think that a "packet logger" is either difficult to obtain or difficult to use. Neither is true. It takes ...


10

If you read Schneier, you'll be familiar with one of the basic premises of "smart" security that he also pushes a lot: Security is a Trade-off. It simply does not make sense to go full metal paranoid on your systems, since security can NEVER be 100% anyway (we used to be told the only way to be 100% is to unplug the computer... now we know that's ...


9

Short answer: Yes, computers can get a whole lot wrong before any human can realize that there's a problem so "trust" just doesn't work in computer systems. Default distrust is the only viable posture for high-performance system. To explain why, I'll contrast interactions between computers to interactions between humans. In human interactions, default ...


8

There are two aspects to this. The first, as you mention, is preventing brute-force attacks. For this purpose, really any number of tries should do - 3, 5, 20, 2000... with a proper password policy (length+complexity+...) giving a large enough keyspace, any kind of throttling (X number of tries per hour) will ensure that bruteforcing the entire space ...


8

I believe I'm late to this debate, but I hope I have something useful to add here. The account lockout policy (with the number of consecutive invalid attempts usually in the range of single digits for most organizations) was not devised solely against automated brute force attacks. It is more of a protection against password guessing by human attackers, ...


7

There's always going to be hackers that do these type of things because they can. The extent to which that pool overlaps with those with malicious intent is the magnitude of the concern, I think. Like anything else in medicine, there is a tradeoff between costs and benefits, so if the convenience to the patient and power to control dosing and other ...


7

I can tell you why I act this way from personal experience. Here is what I have experienced in my life: A friend of mine didn't trust her boyfriend, and installed a snooper on her network. It was some commercial product she just installed on her windows laptop. When he came to her house with his laptop, she was able to get all his plaintext logins. When ...


7

If some people have put some hidden backdoors in your system, and if they were competent at it, then you won't be able to find them. "Competence", here, means "having an Internet access and typing 'rootkit mac os x' in Google". See e.g. this. It is theoretically impossible to completely hide a backdoor, but only in the same sense that it is theoretically ...


7

The way to look at which is better for you is to work out what your risk appetite is. If you must have service at all costs then you don't want to fail closed, as any problem with that IPS will cause a Denial of Service. That is a very rare scenario though - the majority of implementations are configured to protect the server and the data on it. This is ...


6

I suggest reading Krag Brotby's Information Security Management Metrics book for coverage of most of the relevant risk analysis frameworks that are usually tailored to a specific kind of risk (e.g. financial analysis for information security management programs or risk management programs could use ROSI, ALE/SLE, VAR, cost-effectiveness, etc). I also ...


6

The fundamental deference between the two methodologies is that GAIT is qualitative while FAIR is quantitative. Bottom line, GAIT is another one of those methods such as SAS70, SOX, Cobit and the rest that will end up to be a checklist exercise that will tell you nothing about your security or what the monetary value of your IT risk is.


6

The impact may change if the control put in place alters a potential attacker's abilities should the problem be exploited. A good example of where the impact would change is when the mitigation involves segregating networks. Before the segregation, an exploit on OldCorp Unsupported Legacy Daemon X might lead to someone getting access to the internal ...


5

Your question is similar to asking why should I lock my doors but with the twist that all cyber doors get jiggled by would-be intruders constantly. An unprotected system placed on the Internet will undergo simple automated port scan attacks within minutes of being booted ...


5

"IRL" criminal attempts are limited by the resources available (how many bank robbers / thieves / muggers / fraudsters can you get working for you at once; how quickly can you identify and focus on potential victims) and by fear of detectability/traceability (how can you avoid being spotted in the attempt and recognised; how do you avoid being informed on). ...


5

SANS.org have a few really good resources. Including: http://www.sans.org/windows-security/2009/07/11/practical-risk-analysis-spreadsheet/ http://software-security.sans.org/resources/paper/reading-room/threat-modeling-process-ensure-application-security ...


5

In regards to the suggestions of time incrementing 'lock-outs' to delay successive failed attempts and hence prevent brute forcing, do please remember this only works on targeted user attacks. If the attacker only cares about gaining entry to the system, they could perform a breadth first attack (Cycle all known/guessed user names before cycling to the next ...


5

A good source focused on publicly announced data loss is - http://datalossdb.org/


5

Following Neal's suggestion, I am adapting my earlier comment in to an answer... with a bit more detail which is hopefully easier to understand :-) My laptop's hard-drive is fully encrypted so the data on it is safe from thieves and the such. However, I still have Prey (tracker) installed on it with an open access Guest account because I always keep my ...


5

Recently, there's been growing interest from computer security researchers in the security of medical devices, and there's started to build a literature on the subject. Here are some research papers you could read, if interested: Security and Privacy for Implantable Medical Devices. Daniel Halperin, Thomas S. Heydt-Benjamin, Kevin Fu, Tadayoshi Kohno, ...



Only top voted, non community-wiki answers of a minimum length are eligible