meta user
network profile
| bio | website | incapsula.com |
|---|---|---|
| location | ||
| age | 33 | |
| visits | member for | 11 months |
| seen | May 12 at 8:54 | |
| stats | profile views | 30 |
I`m techie and an online-marketing expert - a battle hardened SEO/SEM veteran, with years of hands-on experience and some deep battle scars to show for it.
In my past I served as a SEO/SEM Department Manager in a large hosting company and later on worked as a CTO for a major on-line advertising firm.
Currently I'm a Community Manager at Incapsula.com - an Imperva subsidiary that provides Cloud-based Security & Acceleration services.
Outside of work I`m a father, a son and a husband, a semi-pro Dota player, avid book reader and an award winning writer, entrepreneur, hobby designer, professional couch potato, a community activist and a walker of dogs.
|
May 12 |
revised |
How to verify the authenticity of Facebook users? deleted 39 characters in body |
|
Jan 15 |
answered | Are image uploads also vulnerable to sql injection? |
|
Jan 15 |
revised |
Bot detecting by considering request inter-arrival time added 3 characters in body |
|
Jan 14 |
answered | Bot detecting by considering request inter-arrival time |
|
Jan 3 |
answered | How similar are bots regarding their HTTP GET request? |
|
Dec 25 |
answered | How to restrict web access to certain countries |
|
Dec 10 |
awarded | Revival |
|
Dec 4 |
revised |
IPTables DDoS protection working with per client IP address counter AND UDP added 232 characters in body |
|
Nov 8 |
comment |
Should we force user to HTTPS on website? Also you are correct, Google uses https, ebay, amazon, whitehouse, fbi and cnn don't. Having said that, you made a good point (+1). Still for static pages or for sites that don't allow logins, I personally would use https. In some cases I guess you can "divide" your site and manage all loged request on diffrent httpsed [is this a word?] sub-domain. Still, good point. :) |
|
Nov 8 |
awarded | Commentator |
|
Nov 8 |
comment |
Should we force user to HTTPS on website? If you feel that SSL will fool-proof you against session hijacking I can refer you to these sources (stackoverflow.com/questions/12233406/…) or ( stackoverflow.com/questions/10801916/…) And yes, it will help but then again this is just another barrier your can raise, not a solution. As to the speed issues, you don't have to be google to care about it. A hosting company with 10,000 clients can serve millions of sessions per day, if all are https that the slowdown will be noticeable for all. |
|
Nov 7 |
comment |
Should we force user to HTTPS on website? So you think you should HTTPS static Html pages? As to the speed effect, this depends. For prolonged visits (multi-page sessions) even a short delay can accumulate. Try browsing a on-line store with https at all pages... Now think about it from a hoster's stand point, he has so serve hundreds if not millions of sessions per minute even a 0.001% delay is noticeable and will cause "parasitic drag" for all sites. |
|
Nov 7 |
awarded | Critic |
|
Nov 6 |
answered | Should we force user to HTTPS on website? |
|
Oct 30 |
comment |
Vulnerability scanning applicability for PCI DSS Also, I understand that the data is fully encrypted but I don't think that this changes things. Statement like "there is no way anyone could hack that or retrieve the decryption keys..." sounds too good to be true and some guys I know would consider this a challenge :) Still, I would like to learn more here. If you will obtain an official answer to this (and I think you should), please post it here so we can learn more from it. Thanks! |
|
Oct 30 |
comment |
Vulnerability scanning applicability for PCI DSS Understood. The answer is "Yes". For PCI DDS compliance you MUST run quarterly audits and "Yes", if you store CC data you should be compliant - even if not accessing it directly. (PCI compliance required for handling of CC data, this includes storing/transmitting) Having said that, I think you'll find that - once initially performed - the quarterly scans are not as taxing as the "audit after each change" 6.6 requirements. Maybe it will be different in your case, as it depends on change rates, but this is how things are in general... |
|
Oct 28 |
answered | Are there special attack vectors for statistical databases? |
|
Oct 28 |
comment |
Vulnerability scanning applicability for PCI DSS Interesting point. I know that PCI DDS also calls for quarterly vulnerability scans but this is not as time consuming as OP described (simply because of the required rate of once/3 month). Still, the scan itself is not nearly as demanding as the resulting patching and with PCI compliant WAF, this should not be required, simply because the WAF will compensate for code related vulnerabilities. Of course this is not "plug in and get full PCI compliance forever" tool :) Still, it will help a lot. |
|
Oct 28 |
answered | Vulnerability scanning applicability for PCI DSS |
|
Oct 24 |
revised |
If I storing my own cards in a database. Does this fall under PCI compliance framework? added 8 characters in body |
