Tag Info

New answers tagged

0

There is a new concept called "Active Cyber Defense Cycle" which utilizes all three in a cycle rather than hierarchy. What this means is that Threat Intelligence particular to your environment is always analyzed and fed to Incident Response. Responses are informed by knowledge of the internal network and empowered to make fast changes to network ...


0

The biggest thing you want to do is to understand and then communicate what your expectations are. If your security model forbids opening a firewall port, is that documented? (As an aside, if you expect that you're safe because you're behind a firewall, I suggest rethinking, but I think you're using that as an example.) You can either document in a ...


1

Typically, your code would be tested & remediated against vulnerabilities in pre-prod/staging environments before going in to production. Yes, not all environments are same so some measures I've taken are using Splunk (aka log correlation tools) to monitor deployments and correlating it with web activities for {x} hours after the deployment. This ...


2

Typically what you would do here is integrate some form of testing procedure into your deployment or post-deployment process. This could be as lightweight as a simple port scan, which could identify ports left open inadvertently, or as large as a full 3rd party security assessment (aka penetration test) where you contract a 3rd party to review the security ...


1

Appropriate audiences is the right phrase to use. Certainly some missives are more appropriately cast in a manner that would make them palatable to the listener. The interaction between a group of two is entirely different from a crowd of thousands. Similarly, would you like to know that the doctor who treats your disease had a teenhood that encompassed ...


2

I would like to quote Edward Snowden on this: Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say. Just because you have nothing to hide (you likely do, but let's assume you are really OK with your government, foreign ...


4

For the fraud and "identity theft" angle on this, people should remember that dealing with it always takes someone's time and money. Identity theft can be extremely inconvenient or expensive, and your time is not usually covered by insurance. Another angle is price discrimination. "We see you have $1234.50 in your bank account, therefore the price of this ...


22

Positive reasons Instead of a beach holiday, we joined a Christian Mission this summer in Malawi. We're keeping quiet about it in case the children are teased at school. I leapt into the road and saved a toddler's life. I just walked away because I don't want any fuss. Controlling dissemination My wife is pregnant, great news! We want to tell close ...


11

Just to address one point: Credit card insurance protects them from fraud This makes several assumptions, none of which are to be relied on: You assume that the insurance will pay out. It would be safer to assume that the insurer will try to avoid paying out, and require you to prove that you didn't give away your card details. This may be tricky if ...


1

One of the reasons to guard your privacy is that whilst the government is doing its best (ehem) to protect you from criminals, the latter also have methods to get the information about you, wire-tap your phones, and eavesdrop your communications. There are powerful crime syndicates out there that have the technical abilities of law enforcement. And this is ...


27

There's a great short essay written by Bruce Schneier on the right of privacy: The most common retort against privacy advocates -- by those in favor of ID checks, cameras, databases, data mining and other wholesale surveillance measures -- is this line: "If you aren't doing anything wrong, what do you have to hide?" Some clever answers: "If ...


0

Another usage of passwords in firmware: UEFI has a network stack, and to do PXE it may use authentication (CHAP?). IPSec is also available. So some network usage of UEFI will require a login/password. UEFI has a User Identification driver model, and UEFI 2.5 also added smartcard driver models. HTH, Lee http://firmwaresecurity.com/feed



Top 50 recent answers are included