Reputation
316
Top tag
Next privilege 500 Rep.
Access review queues
Badges
4 10
Newest
 Caucus
Impact
~23k people reached

  • 0 posts edited
  • 0 helpful flags
  • 50 votes cast
Jul
24
awarded  Caucus
Jul
24
awarded  Constituent
Jan
31
awarded  Nice Answer
Jun
27
comment How can I watch porn, safely, and not get a virus? (and not infect corporate data also)
You can show your colleagues this classic Salmon Days video (somewhat loud - Headphones advised)
Dec
19
comment How does changing your password every 90 days increase security?
While competent admins are going to secure the actual shadow password file, organizations as a whole tend to be more lax about backups, particularly older backups. . . . this is why competent admins ENCRYPT THEIR BACKUPS. (It saddens me that I'm the first person to leave this comment in the 18 months since this answer was posted)
Sep
25
awarded  Commentator
Sep
25
comment What expertise is required to create an Windows intrusion report?
@Kasius It varies depending on the problem. If you suspect the system is going to self-destruct and destroy evidence then crashing it hard is sometimes better than letting it self-destruct. Conversely if the "interesting" code is only in RAM pulling the plug destroys any chance at capturing that data. (You also need to consider the observer effect when acquiring memory dumps)
Sep
13
comment CRIME - How to beat the BEAST successor?
@ThomasPornin It's worth pointing out that there doesn't seem to be away to explicitly control SSL-level compression on Apache 2.2 (at least as of 2.2.23 from today, unless I'm missing something or they didn't update docs yet).
Aug
31
awarded  Quorum
Aug
28
answered Server monitoring for security
Aug
28
comment Server monitoring for security
Security.SE does not do product and service recommendations -- I have modified your question to be a bit more toward the "What sort of threats do I look for?" angle rather than the "What software should we buy/run/install?" angle.
Aug
21
awarded  Caucus
Aug
21
awarded  Constituent
Jul
25
comment When changing a password, does it have to be completely different?
@curiousguy I can tell you from experience that users don't read that message :-) -- Sometimes you know your password is a candidate for compromise (vendor calls and says "Our password list was stolen." and hashed or not you should assume that password is out), other times you are very confident it's not (your desktop, never connected to the internet). If you're uncertain best practices dictate you assume your password is compromised.
Jul
25
comment When changing a password, does it have to be completely different?
@Celeritas If your company has a (IMHO stupid) policy that your password must be rotated every N days "just because" and you have no reason to suspect your password compromised then you can make minor changes to your password to meet the requirement. This of course assumes your password is inherently strong, and remains so if you make only minor changes. (Do however bear in mind shoulder-surfing attacks. If lots of people see you type your password a radical change occasionally is a good idea :-)
Jun
8
awarded  Constituent
Jun
8
awarded  Caucus
Apr
3
awarded  Talkative
Feb
3
comment Most secure data storage?
If you go with the dog idea you should use reprogrammed psychotic AIBOs instead of live dogs -- AIBOs can survive the halon discharge.
Jan
28
awarded  Yearling