Tag Info

New answers tagged

1

FCrDNS should only be required when the end user needs to properly identify itself with a domain or organization, commonly used for email where the from address header should match the PTR of the sending IP (IPv4 or IPv6 Address). Actually Tom, if you notice Google requires IPv6 initiated email connections to have a proper RDNS, so that's out. The fact is ...


2

You can use Wireshark to extract conversation statistics from the packet captures. This information can then be sorted through to determine which ports are used regularly: This screen is from the Wireshark Statistics->Conversations menu items. It also has a "Copy" button which will allow you to get this data as CSV; you could then extract destination ...


1

I don't know if i understand your question well enough, but to me this sounds like all you really want is to open the pcapng-file(s) in Wireshark. Maybe my answer is totally off the track. If this is the case, please specify your question further.


0

Cloud providers can provide single tenant hardware so your VMs are isolated from other customers and clients. A number of financial regulators are expecting this to be enabled for confidential / regulated data when stored in the cloud. For example, Amazon AWS has the concept of a 'dedicated instance'. See ...


3

As far as tools themselves go, they're too many to count. They're new tools that are being made every day that a simple google search of what you're testing should suffice. Needless to say, people have collected these tools into operating systems for use. Here are a list of a few. Kali Linux Kali linux is probably the most popular as it gains it's roots ...


0

There is a new concept called "Active Cyber Defense Cycle" which utilizes all three in a cycle rather than hierarchy. What this means is that Threat Intelligence particular to your environment is always analyzed and fed to Incident Response. Responses are informed by knowledge of the internal network and empowered to make fast changes to network ...


0

The biggest thing you want to do is to understand and then communicate what your expectations are. If your security model forbids opening a firewall port, is that documented? (As an aside, if you expect that you're safe because you're behind a firewall, I suggest rethinking, but I think you're using that as an example.) You can either document in a ...


1

Typically, your code would be tested & remediated against vulnerabilities in pre-prod/staging environments before going in to production. Yes, not all environments are same so some measures I've taken are using Splunk (aka log correlation tools) to monitor deployments and correlating it with web activities for {x} hours after the deployment. This ...


2

Typically what you would do here is integrate some form of testing procedure into your deployment or post-deployment process. This could be as lightweight as a simple port scan, which could identify ports left open inadvertently, or as large as a full 3rd party security assessment (aka penetration test) where you contract a 3rd party to review the security ...



Top 50 recent answers are included