Tag Info

Hot answers tagged

9

You will want to be sure that a user's e-mail address is correct if you intend to send mail to it that is either: security-sensitive (eg forgotten password reset token), or recurring/high-quantity, to avoid harassing some other person whose address has been entered. This is typically more about weeding out incorrect addresses that have been entered by ...


8

The risk to the recipient is that there could be anything on there. The biggest risk to you is probably reputational damage, as you are just providing empty USB sticks, not delivering them with sensitive information on. I would be surprised if they could hold you liable for loss of their data - I don't know of any cases thus far where this has happened ...


7

As the person who gives the USB keys, your risk is about reputation and possibly legal retaliation; see @Rory's answer. For who receives the key, risks are higher, in particular because what looks like a conventional USB key may declare itself, at the USB level, to be a keyboard, and begin to automatically "type" things wildly. It has been demonstrated. ...


6

A CSRF attack tries to exploit "the trust that a site has in a user's browser" (so says the Wikipedia page, and it is well said). It is about the server accepting a request from the client, on virtue of the request coming with some authentication characteristic which makes the server believe that it comes from the genuine user (which it does) and under the ...


6

There is not government organization overseeing information security. What we have are sets of standards such as PCI or laws like Sarbanes Oxley and HIPPA. When a company wants to do business with MasterCard or Visa they will (usually) be required to be PCI compliant and have an audit done before they can do business. If your business depends on ...


5

The impact may change if the control put in place alters a potential attacker's abilities should the problem be exploited. A good example of where the impact would change is when the mitigation involves segregating networks. Before the segregation, an exploit on OldCorp Unsupported Legacy Daemon X might lead to someone getting access to the internal ...


5

There is no such control. You could further argue that if such control existed, it would almost certainly fail. Certain industries have their own regulation; for example there's HIPAA for health care, SOX for publicly traded companies, and a whole panoply of regulation for defense and federal contractors. Most of these rules have nothing to do with IT ...


5

What is the implication of verifying it? The referer header: can be spoofed by the client can be completely omitted by the client (notoriously when going through TOR/proxies) is no guarantee that the user actually came from there There referer header is sent as a courtesy from your browser, it is not a HTTP RFC requirement. See here for details on the ...


4

Besides what the Jippie points out, you have no reassurance regarding confidentiality in a Cloud environment. For instance when using Google Docs you allow Google to apply datamining on your documents. MS 360 however promises not do this (according to their license). You have less control about what happens to your documents in a public cloud. However ...


4

Beyond the general "don't tell anybody anything" advice, which is entirely true, there are a couple interesting things about process start time from an attacker's point of view. if you manage to crash a process, its start time will be reset. You could use that info to figure out which other attacks were working. some systems have had vulnerabilities where ...


4

Suppose that you have a pseudorandom function with an output of n bits. A good hash function with a given salt ought to behave like a PRF. The general, average structure of a PRF, with regards to repeated application, is to have one big "cycle": if you hash and rehash repeatedly, you will, at some point, enter a cycle and obtain a value which you already ...


4

This sounds like a homework question. The short answer is: there is no authority for IT as a whole, as the FDA for example has legal mandates and the power to punish. There is no agency that has this power over IT or IT Security. There are however laws that apply to security in certain industries like health care or financial services, but that is a fairly ...


4

USB flash drives are an extraordinarily bad promotional item. Because of the frequent malware, most companies now have rules forbidding employees from accepting them, or to destroy them if they already have. Remember that malware comes in many forms on such drives. The latest to appear is where hackers reprogram the firmware on the devices, such that they ...


3

depends on what you mean by "controls" then. given the fact you use a monitoring-system you still will have the impact of a service going down, but you will get noticed very soon and can start recovery. or, if monitoring intelligently, get noticed and act before a service might go down. the sames goes for implemented standby-systems that could take over ...


3

Allow me to preface my answer with this: The real world is not like the movies - it's vastly easier to hide a camera somewhere and point it at your screen, or pick the lock on your door and upload a virus to your laptop, or copy the hard drive than it is to sit in a van down the street and read stray EM waves from your monitor... so if someone wants to spy ...


3

No. There's something to be said for the fact that if you "own" a machine, then you own it. Physical possession of a piece of hardware with the ability to disassemble, modify, and otherwise physically hack the device very nearly guarantees that with enough work you will be able to get around security measure that might be present. So, no, JTAG is no more ...


3

If you plan on sending email to that address then you need to verify to avoid being identified as a spammer. If you ask the user to agree to a contract and you can't verify identity based on some other information like a CC#, then you need to verify. If not, then if you ever need to go to court for breach of contract, you have no evidence that the person ...


3

It depends on the device. In most Android devices it is possible to physically replace the software in Flash (the so-called "ROM") and thus overcome any software dependent security, in which case an open JTAG port doesn't make things much worse. But there are a few Android devices on the market in which the hardware validates the "ROM" software before it is ...


2

How long is the key they provided? The strength of that key is the strength of any alphanumeric password of that length. Theoretically, anyone that random types characters may be able to guess your gmail password or any other password, but because the number of possible values is very large, the chance of doing so is very small (unless your password is ...


2

What bothering me is that people are managing valuable data -- in some cases, their whole life, and some other data which was entrusted to them -- in devices for which they cannot, do not, and not even try to, maintain physical security. A phone is something which is: expensive; small enough to be easily carried, but large enough to allow for easy ...


2

I think you may find that this question is so huge in function and scope that you won't find such definitive lists (though I'd also love to see one.) Publicly, you are more likely to find mean-(time-to or between)-failure of hardware than for software simply because physical engineering will be concerned with those figures during the life-cycle. Of course, ...


2

You should implement e-mail confirmation for new users, if for nothing else than 'security theater,' users expect that once they sign up for a service using an e-mail as an identifier they expect verification. Taking your question in a vacuum without making further assumptions, the risk to your users or really potential users is relatively low. The risk to ...


2

All computers. Say whatever service is running on that port (e.g., web server, database server, etc) is found to be vulnerable to an attack that allows the attacker to execute any code of his choosing on the server (typically we call this a remote code execution attack). The attacker could leverage this to then begin attacking other computers on the ...


1

Your definition of risk is Risk = Impact(event) * Probability(event). The general case is expected value, or E(x) = x * Prob(x). If we want to describe it in measurable terms, dollar value is the most general metric of choice that people can be convinced to care about, so Dollars-at-Risk = Loss due to event * Probability of event occurring Your ...


1

What you are asking is fundamentally impossible in the general sense. But you may be able to tell if the file is safe under a limited set of allowances. For example, a plain text file can be guaranteed "safe" to the extent that you can also guarantee that your plain text viewer is free of any vulnerabilities or arbitrary execution paths. Your guarantee ...


1

Solving such a problem in practice depends a bit on the nature of what you're downloading, what you will be doing with it and how soon you need the data. If this data file is destined to be fed to a specialized program (and not accessed by a user), then a simple security measure would be to encrypt it and then save it to the disk. The program can then ...


1

Download from a reputable location. If it is a human readable format, take a look at the data and run some scans for potential exploits. If it isn't human readable, see first response unless the data file can be opened in a way that guarantees it can't be executed. If you trust the source but are worried about it having been altered where it is stored, ...


1

Whilst this is not a complete answer, I wouldn't accept any answer that does not at least mention NIST in this context. I believe that their standards and recommendations are only binding to IT security of the US Federal Government. Yet their practical importance (as guidelines or basis for industry standards) far exceeds that. Find more info at ...


1

Tests, automated or not, cannot detect backdoors. Tests detect non-malicious errors. It is easy to hide a backdoor that no test wil ever detect. If you want to be sure that there is no backdoor in your software, then there is only one solution: write it yourself. This extends to the software tools (define your own language, write the compiler), the ...


1

For a login form -- not so much. The most that could happen is a well-known site like Facebook could go rogue and use their clients' machines (via POST requests from an embedded form triggered by javascript) as part of a botnet-like entity to bruteforce your login form. But that's rather unlikely, so there's no problem with not checking referers on login. ...



Only top voted, non community-wiki answers of a minimum length are eligible