Tag Info

Hot answers tagged

11

You will want to be sure that a user's e-mail address is correct if you intend to send mail to it that is either: security-sensitive (eg forgotten password reset token), or recurring/high-quantity, to avoid harassing some other person whose address has been entered. This is typically more about weeding out incorrect addresses that have been entered by ...


8

The risk to the recipient is that there could be anything on there. The biggest risk to you is probably reputational damage, as you are just providing empty USB sticks, not delivering them with sensitive information on. I would be surprised if they could hold you liable for loss of their data - I don't know of any cases thus far where this has happened ...


7

As the person who gives the USB keys, your risk is about reputation and possibly legal retaliation; see @Rory's answer. For who receives the key, risks are higher, in particular because what looks like a conventional USB key may declare itself, at the USB level, to be a keyboard, and begin to automatically "type" things wildly. It has been demonstrated. ...


6

A CSRF attack tries to exploit "the trust that a site has in a user's browser" (so says the Wikipedia page, and it is well said). It is about the server accepting a request from the client, on virtue of the request coming with some authentication characteristic which makes the server believe that it comes from the genuine user (which it does) and under the ...


6

What is the implication of verifying it? The referer header: can be spoofed by the client can be completely omitted by the client (notoriously when going through TOR/proxies) is no guarantee that the user actually came from there There referer header is sent as a courtesy from your browser, it is not a HTTP RFC requirement. See here for details on the ...


6

There is not government organization overseeing information security. What we have are sets of standards such as PCI or laws like Sarbanes Oxley and HIPPA. When a company wants to do business with MasterCard or Visa they will (usually) be required to be PCI compliant and have an audit done before they can do business. If your business depends on ...


5

There is no such control. You could further argue that if such control existed, it would almost certainly fail. Certain industries have their own regulation; for example there's HIPAA for health care, SOX for publicly traded companies, and a whole panoply of regulation for defense and federal contractors. Most of these rules have nothing to do with IT ...


5

The impact may change if the control put in place alters a potential attacker's abilities should the problem be exploited. A good example of where the impact would change is when the mitigation involves segregating networks. Before the segregation, an exploit on OldCorp Unsupported Legacy Daemon X might lead to someone getting access to the internal ...


4

USB flash drives are an extraordinarily bad promotional item. Because of the frequent malware, most companies now have rules forbidding employees from accepting them, or to destroy them if they already have. Remember that malware comes in many forms on such drives. The latest to appear is where hackers reprogram the firmware on the devices, such that they ...


4

Suppose that you have a pseudorandom function with an output of n bits. A good hash function with a given salt ought to behave like a PRF. The general, average structure of a PRF, with regards to repeated application, is to have one big "cycle": if you hash and rehash repeatedly, you will, at some point, enter a cycle and obtain a value which you already ...


4

No. There's something to be said for the fact that if you "own" a machine, then you own it. Physical possession of a piece of hardware with the ability to disassemble, modify, and otherwise physically hack the device very nearly guarantees that with enough work you will be able to get around security measure that might be present. So, no, JTAG is no more ...


4

Besides what the Jippie points out, you have no reassurance regarding confidentiality in a Cloud environment. For instance when using Google Docs you allow Google to apply datamining on your documents. MS 360 however promises not do this (according to their license). You have less control about what happens to your documents in a public cloud. However ...


4

This sounds like a homework question. The short answer is: there is no authority for IT as a whole, as the FDA for example has legal mandates and the power to punish. There is no agency that has this power over IT or IT Security. There are however laws that apply to security in certain industries like health care or financial services, but that is a fairly ...


4

Beyond the general "don't tell anybody anything" advice, which is entirely true, there are a couple interesting things about process start time from an attacker's point of view. if you manage to crash a process, its start time will be reset. You could use that info to figure out which other attacks were working. some systems have had vulnerabilities where ...


3

It depends on the device. In most Android devices it is possible to physically replace the software in Flash (the so-called "ROM") and thus overcome any software dependent security, in which case an open JTAG port doesn't make things much worse. But there are a few Android devices on the market in which the hardware validates the "ROM" software before it is ...


3

If you plan on sending email to that address then you need to verify to avoid being identified as a spammer. If you ask the user to agree to a contract and you can't verify identity based on some other information like a CC#, then you need to verify. If not, then if you ever need to go to court for breach of contract, you have no evidence that the person ...


3

No. The biggest risk I fear is some government closing down the service because of suspected illegal use, taking all disks for analysis and leaving me as sincere user without my file backups. eg. Megaupload (Megabackup)


3

depends on what you mean by "controls" then. given the fact you use a monitoring-system you still will have the impact of a service going down, but you will get noticed very soon and can start recovery. or, if monitoring intelligently, get noticed and act before a service might go down. the sames goes for implemented standby-systems that could take over ...


3

Allow me to preface my answer with this: The real world is not like the movies - it's vastly easier to hide a camera somewhere and point it at your screen, or pick the lock on your door and upload a virus to your laptop, or copy the hard drive than it is to sit in a van down the street and read stray EM waves from your monitor... so if someone wants to spy ...


2

You should implement e-mail confirmation for new users, if for nothing else than 'security theater,' users expect that once they sign up for a service using an e-mail as an identifier they expect verification. Taking your question in a vacuum without making further assumptions, the risk to your users or really potential users is relatively low. The risk to ...


2

For a login form -- not so much. The most that could happen is a well-known site like Facebook could go rogue and use their clients' machines (via POST requests from an embedded form triggered by javascript) as part of a botnet-like entity to bruteforce your login form. But that's rather unlikely, so there's no problem with not checking referers on login. ...


2

What bothering me is that people are managing valuable data -- in some cases, their whole life, and some other data which was entrusted to them -- in devices for which they cannot, do not, and not even try to, maintain physical security. A phone is something which is: expensive; small enough to be easily carried, but large enough to allow for easy ...


2

How long is the key they provided? The strength of that key is the strength of any alphanumeric password of that length. Theoretically, anyone that random types characters may be able to guess your gmail password or any other password, but because the number of possible values is very large, the chance of doing so is very small (unless your password is ...


2

I think you may find that this question is so huge in function and scope that you won't find such definitive lists (though I'd also love to see one.) Publicly, you are more likely to find mean-(time-to or between)-failure of hardware than for software simply because physical engineering will be concerned with those figures during the life-cycle. Of course, ...


2

All computers. Say whatever service is running on that port (e.g., web server, database server, etc) is found to be vulnerable to an attack that allows the attacker to execute any code of his choosing on the server (typically we call this a remote code execution attack). The attacker could leverage this to then begin attacking other computers on the ...


2

Yes, you card can be misused at various places. Though, it has never happened to me, I believe there are some websites which accept payments from debit cards without any secure 3D password. All they ask for is CVV and Card#. I would suggest you to block it right away.


1

Tests, automated or not, cannot detect backdoors. Tests detect non-malicious errors. It is easy to hide a backdoor that no test wil ever detect. If you want to be sure that there is no backdoor in your software, then there is only one solution: write it yourself. This extends to the software tools (define your own language, write the compiler), the ...


1

email confirmation will help you determine that the person who says their email is foo@bar.com actually has control of this email. The benefits of forcing them to confirming their email are: You verify that the email address is exists and mail can be sent to it You verify that they actually have access to the inbox should I be implementing an email ...


1

How about hacker by Steve Jackson games? http://www.sjgames.com/hacker/ I've used it for exactly what you are asking about.


1

There is a site you can use for team play (laptops,iPads,etc) http://jeopardylabs.com/play/risk-management-jeopardy4



Only top voted, non community-wiki answers of a minimum length are eligible