Tag Info

Hot answers tagged


When they don't know it is there and have only the domain name, they are unlikely to find it without guessing. But guessing is not uncommon. When you put a webserver online it won't take long until you will have bots probing it for vulnerabilities by flooding it with requests for all kinds of probably interesting files. What you are doing is very insecure, ...


If you were to access the secret page from your browser, it could send the URL to Google. Google then could add that page to it's database (since you didn't forbid that with robots.txt). After that, anybody can search 'site:yourdomain.com' and see your secret page.


TLS 1, when properly configured has no known security vulnerabilities. Newer protocols are better designed and better address the potential for new vulnerabilities. So that's why I wouldn't personally recommend disabling TLS 1.0, primarily because IE 7-10 don't support TLS 1.1 out of the box. If you look carefully at the support matrix at: ...


The "level" of security for this really depends on what the XML files contain. If the XML files confidential data then you may want to explore further techniques than discussed here. The suggestion of using basic auth can work however there are many reasons why you should consider using a different authentication method which has been discussed in the ...


I also recommend disabling TLS 1.0 if possible and supporting the most modern cryptography and cipher suites your web servers can handle. TLS 1.0 is vulnerable in many implementations to a couple well-known attacks such as BEAST and POODLE. There's also some crypto issues in TLS 1.0, such as cryptograhpic initialization vectors (IV's) being predictable in ...


You need to ensure the point to point connection between your app is compliant with pci dss (ie strong encryption etc.)and additionally you will need an attestation of compliance from the third party. They should have this if they are pci dss compliant.


A little bit of googling(after on access scan clamav) came up with Clamuko, it seems to let you enable on access scanning of files. The question that remains is if clamav would have caught the threat. Another option could be to look into Sophos' Linux scanner, it can also be configured for on-access scanning Quick little sysadmin edit: I wouldn't suggest ...

Only top voted, non community-wiki answers of a minimum length are eligible