Hot answers tagged

22

Take a passive approach and do a risk assessment. Security management is a form of risk management. You have assets which might have threats and vulnerabilities. A threat exploiting a vulnerability is a risk, which is calculated by calculating (quantitative) or estimating (qualitative) the likelihood and impact (most of the time it's high,medium,low but some ...


22

The username is not a secret; any determined attacker will be able to find out the names of users on your system. What does improve your security, is if there is no remote access for "root", "guest", and similar account names found on many systems. In fact, Ubuntu explicitly disables the "root" account because it is such a favorite target.


12

You will want to be sure that a user's e-mail address is correct if you intend to send mail to it that is either: security-sensitive (eg forgotten password reset token), or recurring/high-quantity, to avoid harassing some other person whose address has been entered. This is typically more about weeding out incorrect addresses that have been entered by ...


9

The risk to the recipient is that there could be anything on there. The biggest risk to you is probably reputational damage, as you are just providing empty USB sticks, not delivering them with sensitive information on. I would be surprised if they could hold you liable for loss of their data - I don't know of any cases thus far where this has happened ...


9

There are different ways to deal with this, ranging from questionably ethical but highly effective, down to completely passive. If you really want to show them that physical attacks work, break in during your next pentest. I don't mean "grab a crowbar", but rather walk into the lobby, walk past reception, and walk straight into their offices. If they ...


8

As the person who gives the USB keys, your risk is about reputation and possibly legal retaliation; see @Rory's answer. For who receives the key, risks are higher, in particular because what looks like a conventional USB key may declare itself, at the USB level, to be a keyboard, and begin to automatically "type" things wildly. It has been demonstrated. ...


6

A CSRF attack tries to exploit "the trust that a site has in a user's browser" (so says the Wikipedia page, and it is well said). It is about the server accepting a request from the client, on virtue of the request coming with some authentication characteristic which makes the server believe that it comes from the genuine user (which it does) and under the ...


6

What is the implication of verifying it? The referer header: can be spoofed by the client can be completely omitted by the client (notoriously when going through TOR/proxies) is no guarantee that the user actually came from there There referer header is sent as a courtesy from your browser, it is not a HTTP RFC requirement. See here for details on the ...


6

There is not government organization overseeing information security. What we have are sets of standards such as PCI or laws like Sarbanes Oxley and HIPPA. When a company wants to do business with MasterCard or Visa they will (usually) be required to be PCI compliant and have an audit done before they can do business. If your business depends on ...


6

The impact may change if the control put in place alters a potential attacker's abilities should the problem be exploited. A good example of where the impact would change is when the mitigation involves segregating networks. Before the segregation, an exploit on OldCorp Unsupported Legacy Daemon X might lead to someone getting access to the internal ...


6

one-letter is indeed a bit short, but a good IDS can quickly see if someone is messing with your network if 3 letter usernames are being used. But from a security standpoint one should assume the Username is known to an attacker since its often easy to guess or not protected at all (leaked at some other place) so short usernames are not so much an issue, ...


5

USB flash drives are an extraordinarily bad promotional item. Because of the frequent malware, most companies now have rules forbidding employees from accepting them, or to destroy them if they already have. Remember that malware comes in many forms on such drives. The latest to appear is where hackers reprogram the firmware on the devices, such that they ...


5

Suppose that you have a pseudorandom function with an output of n bits. A good hash function with a given salt ought to behave like a PRF. The general, average structure of a PRF, with regards to repeated application, is to have one big "cycle": if you hash and rehash repeatedly, you will, at some point, enter a cycle and obtain a value which you already ...


5

If you plan on sending email to that address then you need to verify to avoid being identified as a spammer. If you ask the user to agree to a contract and you can't verify identity based on some other information like a CC#, then you need to verify. If not, then if you ever need to go to court for breach of contract, you have no evidence that the person ...


5

There is no such control. You could further argue that if such control existed, it would almost certainly fail. Certain industries have their own regulation; for example there's HIPAA for health care, SOX for publicly traded companies, and a whole panoply of regulation for defense and federal contractors. Most of these rules have nothing to do with IT ...


5

The short answer is that I don't believe you can. One input field on one page may be far more important than 100 on another for example. The issue is that you cannot assess risk without access to more information. Risk is calculated by the ease and likelihood of a vulnerability being exploited multiplied by the damage that would be inflicted by its ...


5

The "by the book" approach to this is to use a key-stretching/key-derivation-function to turn a one secret into another (longer) secret. Or two or more secrets. One for HMAC, one AES session key, etc. This is what TLS does. It expands the master secret into a block of six single other secrets. I can not name a practical attack if you don't do that. But ...


4

This sounds like a homework question. The short answer is: there is no authority for IT as a whole, as the FDA for example has legal mandates and the power to punish. There is no agency that has this power over IT or IT Security. There are however laws that apply to security in certain industries like health care or financial services, but that is a fairly ...


4

Beyond the general "don't tell anybody anything" advice, which is entirely true, there are a couple interesting things about process start time from an attacker's point of view. if you manage to crash a process, its start time will be reset. You could use that info to figure out which other attacks were working. some systems have had vulnerabilities where ...


4

No. There's something to be said for the fact that if you "own" a machine, then you own it. Physical possession of a piece of hardware with the ability to disassemble, modify, and otherwise physically hack the device very nearly guarantees that with enough work you will be able to get around security measure that might be present. So, no, JTAG is no more ...


4

Besides what the Jippie points out, you have no reassurance regarding confidentiality in a Cloud environment. For instance when using Google Docs you allow Google to apply datamining on your documents. MS 360 however promises not do this (according to their license). You have less control about what happens to your documents in a public cloud. However ...


4

No. The biggest risk I fear is some government closing down the service because of suspected illegal use, taking all disks for analysis and leaving me as sincere user without my file backups. eg. Megaupload (Megabackup)


3

You should implement e-mail confirmation for new users, if for nothing else than 'security theater,' users expect that once they sign up for a service using an e-mail as an identifier they expect verification. Taking your question in a vacuum without making further assumptions, the risk to your users or really potential users is relatively low. The risk to ...


3

It depends on the device. In most Android devices it is possible to physically replace the software in Flash (the so-called "ROM") and thus overcome any software dependent security, in which case an open JTAG port doesn't make things much worse. But there are a few Android devices on the market in which the hardware validates the "ROM" software before it is ...


3

depends on what you mean by "controls" then. given the fact you use a monitoring-system you still will have the impact of a service going down, but you will get noticed very soon and can start recovery. or, if monitoring intelligently, get noticed and act before a service might go down. the sames goes for implemented standby-systems that could take over ...


3

Allow me to preface my answer with this: The real world is not like the movies - it's vastly easier to hide a camera somewhere and point it at your screen, or pick the lock on your door and upload a virus to your laptop, or copy the hard drive than it is to sit in a van down the street and read stray EM waves from your monitor... so if someone wants to spy ...


3

It is no more dangerous than allowing a desktop to access an IP when they are browsing the Internet. It would be dangerous to assign a static IP, have insecure services exposed. Two separate issues. When you connect to the Internet from a business or a home network, or any network for the most part, chances are you will have a firewall somewhere in the loop. ...


2

What bothering me is that people are managing valuable data -- in some cases, their whole life, and some other data which was entrusted to them -- in devices for which they cannot, do not, and not even try to, maintain physical security. A phone is something which is: expensive; small enough to be easily carried, but large enough to allow for easy ...


2

First of all I suggest you have a look at the services's website and read how it handles security. This gives you a basic idea of how much the service cares about the safety of your data. Of course, this means nothing, but it's still something, and it also allows you compare different services. The best you can do to keep your data secure is encrypting it ...


2

IMHO, one big issue regarding the security of your cloud-stored data is the fact that usually cloud services don't store the data encrypted on their servers. As jippie pointed out, client side encryption is the magic word. If your data is already encrypted before it gets uploaded, the cloud provider has no chance to access your data. As far as I know, wuala ...



Only top voted, non community-wiki answers of a minimum length are eligible