486 reputation
16
bio website incapsula.com
location
age 34
visits member for 1 year, 9 months
seen Mar 3 at 5:42

I`m techie, a security geek and a battle hardened SEO/SEM veteran. Today I'm a Product Evangelist at Incapsula, an Imperva subsidiary that provides cloud-based Security & Acceleration services.

Outside of work I`m a father, a son and a husband, an avid book reader and an award winning writer, a semi-pro MOBA player, a professional couch potato and a lover of dogs.


Nov
20
comment What can a zombie computer feasibly install and run?
No, but we should have the data to research this and publish a case-study. Thanks for the idea!
Nov
13
answered What can a zombie computer feasibly install and run?
Aug
21
revised Bot detecting by considering request inter-arrival time
deleted 9 characters in body
Jul
2
awarded  Yearling
May
12
revised How to verify the authenticity of Facebook users?
deleted 39 characters in body
Jan
15
answered Are image uploads also vulnerable to sql injection?
Jan
15
revised Bot detecting by considering request inter-arrival time
added 3 characters in body
Jan
14
answered Bot detecting by considering request inter-arrival time
Jan
3
answered How similar are bots regarding their HTTP GET request?
Dec
25
answered How to restrict web access to certain countries
Dec
10
awarded  Revival
Dec
4
revised IPTables DDoS protection working with per client IP address counter AND UDP
added 232 characters in body
Nov
8
comment Should we force user to HTTPS on website?
Also you are correct, Google uses https, ebay, amazon, whitehouse, fbi and cnn don't. Having said that, you made a good point (+1). Still for static pages or for sites that don't allow logins, I personally would use https. In some cases I guess you can "divide" your site and manage all loged request on diffrent httpsed [is this a word?] sub-domain. Still, good point. :)
Nov
8
awarded  Commentator
Nov
8
comment Should we force user to HTTPS on website?
If you feel that SSL will fool-proof you against session hijacking I can refer you to these sources (stackoverflow.com/questions/12233406/…) or ( stackoverflow.com/questions/10801916/…) And yes, it will help but then again this is just another barrier your can raise, not a solution. As to the speed issues, you don't have to be google to care about it. A hosting company with 10,000 clients can serve millions of sessions per day, if all are https that the slowdown will be noticeable for all.
Nov
7
comment Should we force user to HTTPS on website?
So you think you should HTTPS static Html pages? As to the speed effect, this depends. For prolonged visits (multi-page sessions) even a short delay can accumulate. Try browsing a on-line store with https at all pages... Now think about it from a hoster's stand point, he has so serve hundreds if not millions of sessions per minute even a 0.001% delay is noticeable and will cause "parasitic drag" for all sites.
Nov
7
awarded  Critic
Nov
6
answered Should we force user to HTTPS on website?
Oct
30
comment Vulnerability scanning applicability for PCI DSS
Also, I understand that the data is fully encrypted but I don't think that this changes things. Statement like "there is no way anyone could hack that or retrieve the decryption keys..." sounds too good to be true and some guys I know would consider this a challenge :) Still, I would like to learn more here. If you will obtain an official answer to this (and I think you should), please post it here so we can learn more from it. Thanks!
Oct
30
comment Vulnerability scanning applicability for PCI DSS
Understood. The answer is "Yes". For PCI DDS compliance you MUST run quarterly audits and "Yes", if you store CC data you should be compliant - even if not accessing it directly. (PCI compliance required for handling of CC data, this includes storing/transmitting) Having said that, I think you'll find that - once initially performed - the quarterly scans are not as taxing as the "audit after each change" 6.6 requirements. Maybe it will be different in your case, as it depends on change rates, but this is how things are in general...