Hot answers tagged threats
24
From what I can tell, there have only been two serious public vulnerabilities in Steam.
Markup injection (XSS) from steam:// links
HTTPS man-in-the-middle attack
Neither are current. I can't see any real risk. However, since Steam is completely unnecessary at work, it's a minor potential risk that could be avoided.
Most likely, he's nit-picking because ...
17
Steam should be treated just like any other application installed on a business computer. Ask yourself if it is needed to perform your job correctly.
When your computer has more software install, it has more areas it can be attacked.
Steam may not have a vulnerability now, but they may accidental release an update that will have a vulnerability in it.
...
13
One notion is called Perfect Forward Secrecy. This applies to situations where you encrypt data and decrypt it almost simultaneously, but you worry about an attacker who would later on obtain a copy of the decryption key. This is a restrictive model, but it applies to SSL connections: the server private key is long-lived (usually, it is stored in a local ...
11
From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...
10
Loss of revenue is the only threat you really need to talk about with business people. Frame the issue in terms of money and emphasize that money will be lost if security is not given a high priority. Explain that money can be lost in the following ways:
Lawsuits due to disclosing sensitive
user information.
Bad publicity, which damages the
brand, which, ...
10
Microsoft has had a horrific security track record. But the real problem in 2011 isn't operating systems, its web applications and web browsers. You should explore projects like Damn Vulnerable Web App, OWASP WebGoat and especially Google Gruyere. You can find pre-built VM's for all of them, and Google is hosting theirs so you don't have to install ...
7
You could be asking one of many questions here.
If you are asking "How do I know that the software I have here is
what the vendor made - could it have been altered before I got it?"
then you will want to compare the hash of what you have to what the
vendor has published, assuming they have. (Almost everyone does
nowadays.)
If you are asking "How can I tell ...
7
Ones I tend to draw on:
Verizon Data Breach Report - this is generally considered THE source on data breaches
Krebs Java Security Report - Krebs is very well respected - various studies, of which this is a grand example
WHID Security Report - also very useful
These are all freely available online, and updated versions available annually (or more often in ...
7
There are 4 basic principles used in cryptography:
confidentiality
integrity
authenticity
non-repudiation.
I will not go through the mathematical aspects involved, instead I will try to offer a more general description.
Confidentiality is assured by the encrypting of data, integrity and authenticity are assured by a signed digest and non-repudiation is ...
7
It really depends on your point of view.
From the outside, the "script kiddie" is, nominally, the wannabe attacker who uses tools written by other people (the "scripts"), without really understanding what is going on. Everybody uses tools written by other people (if only operating systems, C compilers, libraries...), but some people have a certain ...
6
For trade shows, do you HAVE to connect to your live database ? Could you make do with a (recent) copy on a local machine.
The additional risks at a trade show are that you are surrounded by competing companies who would have a commercial interest either in your data or in making your application unavailable (crashing the server). There's also more ...
6
It sounds like you've got a decent grasp on threats, know that what you're doing now is preferable from a security standpoint, and are facing a cost / benefit analysis. With that in mind, here are some alternate thoughts:
Configure MySQL with an SSL frontend. There are some features in MySQL for that, but stunnel may make you less crazy. While client ...
6
The practical upshot of this is that almost all the security departments I work with treat encryption as something which they expect to protect for a length of time and their decisions on what encryption to use are based on how long they need data to be 'secure'
Admittedly the factors which feed into this are woolly, and are prone to change as someone ...
6
NIST 800-53A and NIST 800-115
That's not strictly a test plan, but it is a catalog of the elements of a test plan. If you're working with a government system, that is a list of test standards for the security controls. If you're working on a commercial system, it is a catalog of resources.
Another resource for test plans is SANS Critical 20 Security ...
6
I read somewhere, I forget where, they divided hackers into three levels of expertise.
The lowest level was Script kiddie. Script kiddies have very limited knowledge and almost no knowledge beyond the attack they are attempting. They may not completely understand the attack they are attempting. An example of this would be a person ARP poisoning a network ...
5
There is a good resource on MSDN. Did you had a chance to read about this topic in MSDN Magazine?
Well, here you are the links that may help to define what you look:
Penetration Testing
Vulnerability Assessment and Penetration Testing Plan Templates
5
My group has often used the OSF DataLoss DB for some comparative statistical analysis. By and large the data is gathered through public sources, either reported on the web or by issuing Freedom of Information requests to the various agencies that process breach notifications.
The real benefit is that this information is free, and made available as a ...
5
Trust me when I say there are scanners running days and nights on the net. When you open your DB up to the public, you'll see all sort of scanning attempts in the server log.
Some examples of blind attacks are SQL Slammer worm specifically targetting MS SQL, LizaMoon a mass SQL injection and SpoolCLL targetting weak passwords in MySQL.
So, if you must ...
5
A fantastic book on rootkits and exploiting Win32 systems via them is, "The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System." It has extremely in depth information about rootkits and the process behind them. Be forewarned though, in order to fully appreciate the book, a background in C is highly recommended.
5
"Non-repudiation" is a legal concept which means that you cannot successfully claim not being the source of a given piece of data. Laws for that vary quite a lot around the World, and they tend to change over time, too.
One powerful tool for non-repudiation is digital signatures. Digital signatures do not provide non-repudiation immediately, no more that ...
5
You cannot, generically, reliably rebuild the base certificate from which such a report was generated (apparently with the OpenSSL command-line tool). For instance, you have the string contents of the Issuer and Subject names, but not the information about how they were encoded.
You could use the signature as a discriminant for the certificates. You won't ...
5
The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader:
To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user.
This is a purely loosing battle and you take a chance every time you use an atm. Security is ...
4
Personally, I'd start with getting the representatives of the business talking about their most valued assets. People who are not security professionals generally have a very hard time figuring out threats. And an even harder time figuring out what threats should matter most to them. But most good business people knows what's important to their business - ...
4
One of my favorite lists for kicking of such conversations was created by Intel IT Security.
It can actually be fun to run down the left hand column ("Agent Label") and discuss which type of people are most likely to harm your business. Then the game is to decide what to do to minimize their chances of success.
You can download the PDF to gain more ...
4
As @VirtuosiMedia says, protecting revenue is the "killer feature" for IT security. You can couch questions about threats in terms of costs:
what would it cost to replace that server if it were stolen?
what about the cost to replace the data on the server?
what would be the opportunity cost in lost business during the recovery period?
what would it cost ...
3
Maybe helpful? Identity Theft Resource Center (http://www.idtheftcenter.org/artman2/publish/lib_survey/ITRC_2008_Breach_List.shtml)
2011 breach list: http://www.idtheftcenter.org/ITRC%20Breach%20Report%202011.pdf
3
I typically give two examples of loss of revenue, downtime and fines from opposite ends of the scale - Worldpay's $9M loss in 12 hours from a very simple exploit, and a local small business - to make sure the audience don't feel it couldn't happen to them.
3
What is Non-Repudiation of content? How can we combat it?
I'm not sure you want to combat it!
To repudiate something is to deny all knowledge of, or involvement in, a given action. In the case of an email message, you would be denying you ever sent that message with that content.
I could give a number of reasons for the email that my account sent had ...
3
Nothing is ever really secure.
That's true as long as people are still people. If you ask any developer about their programming project they can probably give you two-to-three hypothetical scenarios where someone could exploit their code (and how). In every development project there are always high-level decisions to be made, many in regard to the level of ...
3
The best you can really do is use ATMs you know or ATMs that have good physical security if one you know isn't available. (go to an ATM inside a bank). Even then, I always spot check the machine for any signs of tampering.
A simple trick that can work well is to make sure the keypad isn't compromised (by looking and pulling on it) and then if it appears ...
Only top voted, non community-wiki answers of a minimum length are eligible
