54 votes
Accepted

What is the difference between "Incident", "Attack" and "event"?

Assuming that you have looked up the official terms and wanted further help: An event is something that has triggered notice. An event need not be an indication of wrongdoing. Someone successfully ...
schroeder's user avatar
  • 129k
20 votes
Accepted

Does broken site functionality pose any security threat?

Broken functionalities in a web application are not a security threat per se, but they might be one. For you as a penetration tester, look out for: Information leakage about the system (stacktraces, ...
Lukas's user avatar
  • 3,188
17 votes

What is the difference between "Incident", "Attack" and "event"?

While schroeder's answer is certainly correct, it might not be formal enough. In the the terms and definitions of the ISO/IEC 27000 you will find the following: threat potential cause of an ...
Tom K.'s user avatar
  • 7,976
14 votes

Should the recent Tiny Chip attack teach us to invest less in our security posture?

No, for so many reasons. First, let's lay out there that right now (2018-10-05) there has been discernible concern within the Security community about the fact that "what we know" so far is very thin ...
gowenfawr's user avatar
  • 72.9k
10 votes
Accepted

Is SS7 a threat any more?

Yes. Why do I say this? It is important to understand what all these vulnerability's are and why they exists (I will be calling the victim "subscriber"): Why do they exists: SS7 was designed ...
Bubble Hacker's user avatar
9 votes
Accepted

Drawbacks of ML in cyber security?

You are asking a couple different questions at once: how is ML implemented by a certain vendor, and how could it be implemented to be effective. Let's focus on the later. I have designed such ...
schroeder's user avatar
  • 129k
8 votes

What is OSINT (open source intelligence)?

Open Source Intelligence is the operation of gathering information about target, from publicly available sources. You don't use anything illegal, you don't get into contact with target so you don't ...
ferit's user avatar
  • 489
8 votes
Accepted

How can I prevent myself from barcode payload attacks?

After going through the code, I'm not sure that it is supposed to exploit or attack anything. It looks like its only purpose is to encode a payload using barcodes. It would be a nice way to import ...
schroeder's user avatar
  • 129k
8 votes
Accepted

Windows Defender found threats in Kali Linux disc image

No, Windows Defender won't run executables inside an .iso image on "run recommended actions" (or in any other situation), and you can't infect your computer this way. Yes, Kali Linux has plenty of ...
Esa Jokinen's user avatar
  • 18.9k
7 votes

How can I prevent myself from barcode payload attacks?

This is remarkably similar to attacks like SQLi, and the remediation is the same. Wherever you allow a barcode to be scanned as input, validate it in the scanner and only allow input that matches ...
Rory Alsop's user avatar
  • 61.5k
5 votes

How should we implement responsible discovery program internally only for our organization employees?

The best way is recognition - after a security issue has been identified or fixed send them some email award template and CC in their manager. The value to them is being able to refer to this item in ...
McMatty's user avatar
  • 3,270
5 votes
Accepted

What is the difference between Anti - APT (Advanced Persistent Threat) and ATP (Advanced Threat Protection)?

Advanced Persistent Threats (APT) describes actual threats. Depending on who you talk to and the context these are sophisticated and targeted attacks by advanced actors with lots of money like states ...
Steffen Ullrich's user avatar
4 votes

Is SS7 a threat any more?

The answer is yes. As explained in this link a similar exploit has been made on Facebook. If you have a phone number linked to your Facebook account, a hacker just needs your phone number and just ...
Guillaume Beauvois's user avatar
4 votes
Accepted

Is it possible to spoof a paired Bluetooth device?

It has been in the past with various devices. It entirely depends on the BT version and implementation on the device. Modern versions of BT (4.x) have good feature sets to prevent these things from ...
HackSlash's user avatar
  • 277
3 votes

Can a smartphone be hacked by calling it?

Very unlikely. I have never heard of an exploit in any cellphone operating system which can be exploited by taking a call from a malicious caller. If there were something like that, it would likely ...
Philipp's user avatar
  • 49.4k
3 votes
Accepted

Threats due to a stolen password db file (e.g. keepass)

If you've picked a strong master password, they've effectively got an encrypted blob of data which they can try brute force your password from, but may never succeed (Assuming that the password DB ...
Matthew's user avatar
  • 27.4k
3 votes

Is broadcasting your Windows computer name a vulnerability?

The user identifiable information is a sensitive topic and if you feel their transport method isn't good enough (lack of encryption) you can raise this to the provider or stop reporting (firewall ...
Purefan's user avatar
  • 3,590
3 votes
Accepted

Do we still refer to a threat as a threat once it has been realised?

You may be looking for 'breach'. As described below, the original threat remains, a breach has occurred, and additional new unmitigated threats may exist where the attacker may be able to do ...
atk's user avatar
  • 2,426
3 votes

How should we implement responsible discovery program internally only for our organization employees?

In my experience, users do not report security issues because of a couple of reasons: They don't care or believe its not their job They don't understand the possible impact of a security ...
pm1391's user avatar
  • 1,437
3 votes

How should we mitigate threats that are keep coming to our security monitoring system?

Threat intelligence has a common issue today which is a large volume of data generated & coming to the consuming enterprise IT set up & threat intelligence feed bundle has three different ...
Telaprolu Aishwarya's user avatar
3 votes
Accepted

How should we mitigate threats that are keep coming to our security monitoring system?

Aha! So you got the cart but forgot the horse!!!! Classic mistake -- your org seems to be in trouble, but you're not alone! Everyone else is like you, so good for asking the question. The answer, of ...
atdre's user avatar
  • 19.1k
3 votes
Accepted

What are the main sources to collect Threat Intelligence Information especially from Dark Web

The best one I've come across for non-Darkweb OSINT gathering so far is the tool named "Harpoon" written in python3. As you pointed out, there are multiple ways to gather OSINT data but aggregating ...
CyberDude's user avatar
  • 141
3 votes

Where do live threat maps get their threat-data from?

... serving accurate information ... I doubt that these information are accurate. There is some truth in it based on what vendors see from honeypots, from installations at customers and from public ...
Steffen Ullrich's user avatar
3 votes
Accepted

DNS communicating with a remote host on an unusual server port 53

Based on the setup described in the question and comments this kind of traffic is likely innocent. You seem to run a DNS server which recursively resolves the domains. In order to resolve a domain it ...
Steffen Ullrich's user avatar
2 votes

Does broken site functionality pose any security threat?

If the application lacks requirements, for example: there should have been a password reset option, then best you can do is report this to your client, but this certainly is not your work. When the ...
Yorick de Wid's user avatar
2 votes

How can I prevent myself from barcode payload attacks?

Barcodes can be to exploited because of fact that most barcodes contain not only numeric and alphanumeric characters, but also full ASCII characters (special ones included) depending on the protocol ...
Overmind's user avatar
  • 8,899
2 votes

How to determine the threat agent for analyzing risk of a threat?

First and foremost you must consider the business goal of the application. Only after you have determined the business goal you are able to define your threat agents. Discuss the motives for the ...
Anders Nordin's user avatar
2 votes
Accepted

Threat modeling a network monitoring software

Many NMS systems work better when deployed using simple network management protocol (SNMP). SNMP allows for greater detail in data versus inference. E.g. without SNMP, the NMS tool relies on ...
munkeyoto's user avatar
  • 8,702
2 votes

How much is known about who is responsible for all the database breaches?

Whilst it is going to be debatable about whether these sources are reliable, there are a fair number of sources of information about data breaches, which generally touch on who they think is ...
Rory McCune's user avatar
  • 62.3k
2 votes

Spoofed number sending threats to students. Can it be traced to sender?

From what we understand, someone used the services provided by Google or another host to create an anonymous threat message and signed it with your son's name. Hosts such as Google usually have logs ...
whoami's user avatar
  • 1,366

Only top scored, non community-wiki answers of a minimum length are eligible