Tag Info

New answers tagged

0

There are a few more things you need to consider which may or may not effect what you desire to write. Firstly being is that real datacenters with SSAE16 certifications have in place controls and monitors which give a full accounting of all the goings on. Authentication and Authorization. When I go into my Tier 4 datacenter, I am required to use my ...


1

Keeping in mind that this is fiction, your scenario could work given some qualifications. Perhaps there was some major breakthrough that day in the study, so it was worth the risk to backup the data on demand.


2

If you want a physical threat, you'd need something that would be a threat to data, but not people. Acid corroding the server stack, for example, might be better. Bob could trigger a backup in safety while racing against time to save what data he could before the server was irrecoverable.


3

A fire is a real threat in a datacenter, but it would certainly not be handled with an emergency data backup. Server Fault has some discussion about what to do in a fire; the consensus there was that as soon as it was identified as an actual fire, you press the emergency poweroff button and release the fire suppressant on your way out the door, and call the ...


11

Most things of importance placed in a data center have a sister installation in a physically separate data center, and if there was a reason to "fail over" from the live to the backup site, it's completely plausible that things like data shipping will occur as part of it. It also will result in a flurry of manual and semi-automatic administrative activity, ...


0

In the SSL/TLS handshake, the client sends (as part of its ClientHello) the maximum version that it supports; then the server chooses the version that will be used, which should be the highest that the server supports but it not higher than the value sent by the client. If the client sends "SSL 3.0" as highest supported version, then the server is right in ...


0

You can simply disallow the lower level of connection if you don't want it used. When establishing an SSL/TLS connection, the server lets the client know what it can support and the two work out what the best option is. If the client supports TLS and is being forced in to SSL3.0 then something is likely wrong on the client end (or it may be an older SSL ...


0

Something is amiss on the client side it sounds like. The client should initiate the session indicating the highest protocol version it can accept. TLS v1 is enumerated as "3.1" to indicate > SSL3: Since the Version numbers negotiated in the ClientHello and ServerHello messages of SSL are 3.0 and below, version numbers to be negotiated with TLS ...


0

If you have a VPN tunnel between A and B, that will allow those two servers to have a conversation private from others on the LAN. It does not prevent access to other resources on the LAN by A or B. For that you'd want to look into VLAN tagging or other router based access controls.


1

You need to do a risk assessment for each site. and consider likelihood as well as consequences. It could be that some of your sites have a much higher likelihood than others. If this is the case, you could consider slightly modified approaches, such as keeping the high risk sites on their own system and only putting the lower risk ones on the shared system. ...


3

Limiting text in an HTML form doesn't really stop buffer overflows because a bad actor can edit your HTML or not use it at all. Buffer overflow vulnerabilities are caused by programming errors. Programs processing the data on the server must, if using fixed size buffers, count characters as they're stored and store no more than the allocated number of ...


1

The answer is the same for both scenarios, you need to add a length validation for the input on the server side before you do any other operation with the data. Whitelisting for only safe characters (A-Z,a-z,0-9) also helps avoid attacks that take advntage of buffer overflows in order to execute arbitrary code. a link for further reference: ...


4

First, may I ask why you think the app is not as secure as the website? Generally speaking, from a security perspective, one of the worse things you can possibly do is to involve PHP, which has more security pitfalls then, well, probably all of the other common technologies combined. Additionally: if you're any sensitive traffic from the app to the ...


7

You're confusing ports, services, vulnerabilities, and exploits. So here is an analogy based on a house. You have a house (server) on a street. That house has three doors (ports), which lead to different places (services). Just because you have doors (ports), doesn't mean someone is going to walk in and steal your jewelry. Ports are opened because a service ...


0

You would need to audit the security of the services running on the ports to have a good idea how exploitable you are. Even then, your typical vulnerability scanner will only make suggestions based on what versions of what services you may be running. The vectorability is something which can be audited, but generally speaking is best left to professionals ...


1

Nothing is "absolutely safe" there will always be a way to crack into any system given enough time and resources. If you have patched all the latest software that's awesome! But that doesn't mean you still don't have to take precautions against weak passwords, spear phishing attacks, or weak code that doesn't prevent vulnerabilities such as SQL injection. ...


3

The question itself relies on some pretty critical, and invalid, assumptions: We know who the attacker is. We know what the attacker does and does not know. We know that the attacker does not know about zero-day vulnerabilities in our system. The attacker's level of knowledge and skill is static. A system can be absolutely safe. We cannot assume to know ...


0

I wouldn't consider this a major security issue as the values are limited to only your system's access to the third party sites. It is less desirable, but the values can be easily invalidated without any bleeding in to other systems that access the same services. It certainly doesn't hurt, and is even wise, to encrypt it, but you would have to encrypt it ...



Top 50 recent answers are included