Reputation
3,888
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
12 38 88
Impact
~385k people reached

Dec
13
comment Could somebody explain how DNS poisoning might occur in this scenario?
How do we know what the IP address should be spoofed to - how do we know the IP address of the higher up DNS server the first one queries when it doesn't have the entry?
Dec
13
accepted Why is a DNS Amplification attack considered a DDoS attack?
Dec
13
comment Why is a DNS Amplification attack considered a DDoS attack?
From this question it sounds as if a single "misconfigured" DNS resolver would be enough to attack someone security.stackexchange.com/questions/93820/… ...so is DNS amplification attack always a DDoS attack?
Dec
13
asked Why is a DNS Amplification attack considered a DDoS attack?
Dec
13
comment Must an attacker using a Smurf attack be on the same network as the victim?
Ok so I have trouble understanding the way you wrote it but I think I know what's going on. Is it before 1999 the standard was for routers to allow incoming broadcast requests from the internet, but after 1999 the standard was for this feature to be disabled by default?
Dec
13
comment Security evaluation terminology
So is this all done before a product is implemented e.g. before programming begins?
Dec
13
accepted Security evaluation terminology
Dec
13
asked Must an attacker using a Smurf attack be on the same network as the victim?
Dec
13
comment What is a YubiKey and how does it work?
How is this better than a USB key with a keyfile? If a Yubikey gets stolen, then the attacker can still use it.
Dec
13
asked How do these techniques work for protecting against SYN flood?
Dec
12
comment Security evaluation terminology
Is it mainly for software development or IT?
Dec
12
awarded  Socratic
Dec
12
revised Security evaluation terminology
updated question
Dec
11
comment Security evaluation terminology
@schroeder it's from lecture slides but also I checked Security Engineering by Anderson. The wiki does help a lot, but still I don't get the part about how something can be implementation independent yet still be about a specific product? Also is this more focused on an existing IT product, or software development?
Dec
11
revised Security evaluation terminology
added 24 characters in body
Dec
11
revised Security evaluation terminology
added 82 characters in body
Dec
11
asked Security evaluation terminology
Dec
10
comment What kind of answer is this textbook question looking for in access control model?
but how do you know from the image Group 2 contains S1?
Dec
10
comment What kind of answer is this textbook question looking for in access control model?
I'm asking, from the first diagram, is it possible to infer which users are in which group (e.g. somehow using process of elimination)?
Dec
10
comment What kind of answer is this textbook question looking for in access control model?
Basically I'm asking, can you explain why you think the question is not consistent?