Reputation
2,149
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
1 7 23
Newest
 Custodian
Impact
~195k people reached

Feb
22
comment How secure is this process for creating passwords?
How north is this city? How pretty is this woman? How hairy is this man? "secure" is a comparative adjective - it has no meaning except in a context. What is the threat you're trying to defend against? State Sponsored Actor? Anklebiters? mischievous friends? Should we assume that someone has access to a list of your passwords, or only one? Are you protecting state secrets or chocolate cookie recepies? I think what you're looking for is "What are some vulnerabilities in this scheme?"
Feb
8
comment Is there an encryption algorithm that is fully secure?
"completely secure" is a meaningless term. And stop to contemplate a security algorithm based on simple computational algorithms - if they are simple for the adversary what value do they have?
Feb
5
revised How does SMTP facilitate sending spam?
edited title
Jan
22
comment How are assets assessed for criticality?
I'm not a huge fan of R=TxV - that formula generates more argument than solutions. Risk = (Likelihood x Impact )/control is better. Best is to collect data for a year and then figure out what formulas make sense. That isn't always practical, so I suggest that you concentrate on analyzing the risk and proposing mitigation.
Jan
22
comment How are assets assessed for criticality?
Nontrivial questions. I don't have a starting list - I argue against starting lists because selecting that list is a critical part of the process; risk management is about the discussion/process, not the goal. 2) Security is a non-functional requirement like all other nonfunctional requirements. If requirements impede your agility, then you are pursuing a dangerous path.
Jan
22
comment How are assets assessed for criticality?
Depends on your organization. CIA is a beginning but there are other assets - reputation, business function, etc. Most risk management guides suggest that you establish the asset categories early in the process (confusingly, they call them "categories")
Jan
19
reviewed Close Can IMSI catchers detect encrypted communications?
Jan
6
comment Is it safe to use Google Authenticator app and SMS instead of passwords
"Safe" is like "pretty" - without an objective yardstick, it is just a personal opinion. On the other hand, nearly anything is more secure than passwords.
Dec
28
awarded  Custodian
Dec
28
reviewed Approve Why do so many browsers show sites with revoked certificates?
Dec
22
comment SIEM system, what are the benefits?
Nobody logs in remotely? You're comparing the physical access control system to the logical access control system and expecting them to match? That's great if you're running a 19th century company.
Dec
21
comment If an RSS feed handles quotes and HTML tags incorrectly, can it be considered a security risk?
page after page of garbage = failure to deliver content correctly = loss of integrity and availability = security risk. Potentially additional consequences.
Dec
18
answered Benefit of randomly generated column names?
Dec
17
comment How far a VPN service is legal? Does it makes my data vunerable for hackers?
If you're asking questions about legality, consult law stack exchange or a Brazilian lawyer - the question will vary depending on who makes the rules.
Dec
15
comment Restricting access to “hacking” sites and tools
Ask your management if they want to enforce a policy that your security staff knows less than the adversary about every issue? Is it the intent to maintain an ignorant security staff?
Dec
14
comment HIPAA/FISMA certification for IT audits
There is, to the best of my knowledge, no such certification; there are companies that will train you to do the evaluation, but HIPAA and FISMA are US government artifacts, and the US government isn't (yet) in the business of issuing certification. if you want to do this, your company will need to differentiate itself from the thousands of other companies that perform the function.
Dec
14
comment Protect software from copy
Have you looked at license management & DRM? (we're ignoring permissions here). The software could try to phone home on install, the software could work only in the presence of a license file which is keyed to the hardware, the software could phone home if there is no license file. Check into your legal/copyright protections (varies with area) Recognize however that you'll cut into your user base; I won't install that software on my computer, I'll choose software from a competitor who treats me like a human being.
Dec
3
answered Where do Access Controls Fit into the Parkerian Hexad?
Nov
30
comment Blacklisting IP addresses — when should we take action?
Isn't the answer quite peculiar to the site? As you state, B2B leads to a different answer than customer focused. Each customer is going to have to make a risk based decision. There is no silver bullet. Do you monitor the IP's after you have blacklisted them? Would it make sense to drop the block after the threat vanishes?
Nov
27
comment How to limit source port for accessing blocked website?
Generally a bad idea to ask for help in breaking your country's laws. I suspect that if I were to answer your question, I would be guilty of racketeering and in violation of the Digital Millennium Copyright Act.