54
votes
Accepted
What is the difference between "Incident", "Attack" and "event"?
Assuming that you have looked up the official terms and wanted further help:
An event is something that has triggered notice. An event need not be an indication of wrongdoing. Someone successfully ...
20
votes
Accepted
Does broken site functionality pose any security threat?
Broken functionalities in a web application are not a security threat per se, but they might be one. For you as a penetration tester, look out for:
Information leakage about the system (stacktraces, ...
17
votes
What is the difference between "Incident", "Attack" and "event"?
While schroeder's answer is certainly correct, it might not be formal enough. In the the terms and definitions of the ISO/IEC 27000 you will find the following:
threat
potential cause of an ...
14
votes
Should the recent Tiny Chip attack teach us to invest less in our security posture?
No, for so many reasons.
First, let's lay out there that right now (2018-10-05) there has been discernible concern within the Security community about the fact that "what we know" so far is very thin ...
10
votes
Accepted
Is SS7 a threat any more?
Yes.
Why do I say this? It is important to understand what all these vulnerability's are and why they exists (I will be calling the victim "subscriber"):
Why do they exists:
SS7 was designed ...
9
votes
Accepted
Drawbacks of ML in cyber security?
You are asking a couple different questions at once: how is ML implemented by a certain vendor, and how could it be implemented to be effective. Let's focus on the later.
I have designed such ...
8
votes
What is OSINT (open source intelligence)?
Open Source Intelligence is the operation of gathering information about target, from publicly available sources. You don't use anything illegal, you don't get into contact with target so you don't ...
8
votes
Accepted
How can I prevent myself from barcode payload attacks?
After going through the code, I'm not sure that it is supposed to exploit or attack anything. It looks like its only purpose is to encode a payload using barcodes. It would be a nice way to import ...
8
votes
Accepted
Windows Defender found threats in Kali Linux disc image
No, Windows Defender won't run executables inside an .iso image on "run recommended actions" (or in any other situation), and you can't infect your computer this way.
Yes, Kali Linux has plenty of ...
7
votes
How can I prevent myself from barcode payload attacks?
This is remarkably similar to attacks like SQLi, and the remediation is the same.
Wherever you allow a barcode to be scanned as input, validate it in the scanner and only allow input that matches ...
5
votes
How should we implement responsible discovery program internally only for our organization employees?
The best way is recognition - after a security issue has been identified or fixed send them some email award template and CC in their manager. The value to them is being able to refer to this item in ...
5
votes
Accepted
What is the difference between Anti - APT (Advanced Persistent Threat) and ATP (Advanced Threat Protection)?
Advanced Persistent Threats (APT) describes actual threats. Depending on who you talk to and the context these are sophisticated and targeted attacks by advanced actors with lots of money like states ...
4
votes
Is SS7 a threat any more?
The answer is yes. As explained in this link a similar exploit has been made on Facebook.
If you have a phone number linked to your Facebook account, a hacker just needs your phone number and just ...
4
votes
Accepted
Is it possible to spoof a paired Bluetooth device?
It has been in the past with various devices. It entirely depends on the BT version and implementation on the device. Modern versions of BT (4.x) have good feature sets to prevent these things from ...
3
votes
Can a smartphone be hacked by calling it?
Very unlikely. I have never heard of an exploit in any cellphone operating system which can be exploited by taking a call from a malicious caller. If there were something like that, it would likely ...
3
votes
Accepted
Threats due to a stolen password db file (e.g. keepass)
If you've picked a strong master password, they've effectively got an encrypted blob of data which they can try brute force your password from, but may never succeed (Assuming that the password DB ...
3
votes
Is broadcasting your Windows computer name a vulnerability?
The user identifiable information is a sensitive topic and if you feel their transport method isn't good enough (lack of encryption) you can raise this to the provider or stop reporting (firewall ...
3
votes
Accepted
Do we still refer to a threat as a threat once it has been realised?
You may be looking for 'breach'. As described below, the original threat remains, a breach has occurred, and additional new unmitigated threats may exist where the attacker may be able to do ...
3
votes
How should we implement responsible discovery program internally only for our organization employees?
In my experience, users do not report security issues because of a couple of reasons:
They don't care or believe its not their job
They don't understand the possible impact of a security ...
3
votes
How should we mitigate threats that are keep coming to our security monitoring system?
Threat intelligence has a common issue today which is a large volume of data generated & coming to the consuming enterprise IT set up & threat intelligence feed bundle has three different ...
3
votes
Accepted
How should we mitigate threats that are keep coming to our security monitoring system?
Aha! So you got the cart but forgot the horse!!!! Classic mistake -- your org seems to be in trouble, but you're not alone! Everyone else is like you, so good for asking the question.
The answer, of ...
3
votes
Accepted
What are the main sources to collect Threat Intelligence Information especially from Dark Web
The best one I've come across for non-Darkweb OSINT gathering so far is the tool named "Harpoon" written in python3. As you pointed out, there are multiple ways to gather OSINT data but aggregating ...
3
votes
Where do live threat maps get their threat-data from?
... serving accurate information ...
I doubt that these information are accurate. There is some truth in it based on what vendors see from honeypots, from installations at customers and from public ...
3
votes
Accepted
DNS communicating with a remote host on an unusual server port 53
Based on the setup described in the question and comments this kind of traffic is likely innocent. You seem to run a DNS server which recursively resolves the domains. In order to resolve a domain it ...
2
votes
Does broken site functionality pose any security threat?
If the application lacks requirements, for example: there should have been a password reset option, then best you can do is report this to your client, but this certainly is not your work.
When the ...
2
votes
How can I prevent myself from barcode payload attacks?
Barcodes can be to exploited because of fact that most barcodes contain not only numeric and alphanumeric characters, but also full ASCII characters (special ones included) depending on the protocol ...
2
votes
How to determine the threat agent for analyzing risk of a threat?
First and foremost you must consider the business goal of the application. Only after you have determined the business goal you are able to define your threat agents. Discuss the motives for the ...
2
votes
Accepted
Threat modeling a network monitoring software
Many NMS systems work better when deployed using simple network management protocol (SNMP). SNMP allows for greater detail in data versus inference. E.g. without SNMP, the NMS tool relies on ...
2
votes
How much is known about who is responsible for all the database breaches?
Whilst it is going to be debatable about whether these sources are reliable, there are a fair number of sources of information about data breaches, which generally touch on who they think is ...
2
votes
Spoofed number sending threats to students. Can it be traced to sender?
From what we understand, someone used the services provided by Google or another host to create an anonymous threat message and signed it with your son's name. Hosts such as Google usually have logs ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
threats × 104threat-mitigation × 19
threat-modeling × 13
vulnerability × 10
attacks × 8
terminology × 6
firewalls × 5
risk-management × 5
malware × 4
risk × 4
web-application × 3
network × 3
penetration-test × 3
hardware × 3
known-vulnerabilities × 3
risk-analysis × 3
insider-threats × 3
soc × 3
encryption × 2
tls × 2
passwords × 2
cryptography × 2
privacy × 2
web-browser × 2
man-in-the-middle × 2