Tag Info

Hot answers tagged

6

A first generic comment is that when you give a key to a friend, there is no way you can prevent that "friend" from sending the same key to other people, or blabbering about your semi-private information. In that sense, encryption cannot make a useful distinction between "keyF" and "keyA". In a security setting, there are only two categories of information: ...


4

A lot of analysis tools look for known data structures (i.e., patterns) in memory that indicate a particular type of information. For instance, malloc'd memory has header (and sometimes trailer) data that point forward and backward in memory to adjacent memory. Free'd memory pointers can jump around in memory if they aren't consolidated/coalesced. Windows ...


3

As usual, the problem is one of definition. Namely, what makes the device 'D' more "genuine" than a PC run by some ill-intentioned individual ? If you get down to it, you will say something like: device D is genuine because that's the true piece of tangible hardware, the accumulation of atoms which came out from the factory. This is fine as far as definition ...


3

The security is only as effective as your trust in your friends to not share it. Distributed systems like this have been thought up before, but adoption is a challenge. You actually really want the information to be replicated across multiple servers so that you have redundancy and can track a graph of where it is. Another alternative idea is that you ...


2

Whether traditional "protections" for sensitive data in desktop RAM (e.g. SecureString) are really needed or not, is debatable. When attackers can read the RAM contents, they already have a lot of control on the machine. We can still justify some proactive measures in the following sense: RAM in a machine may leak to disk, through virtual memory. The ...


2

NoVa Infosec has a good post on this exact topic. I tend to agree with the author's view that Information Security is a super-set of Cyber Security. In my humble opinion "Cyber Security" was most probably a term coined in a late 90's boardroom somewhere by a sales person during his marketing spiel because "Website/Data/System/Internet Security" didn't ...



Only top voted, non community-wiki answers of a minimum length are eligible