1,950 reputation
1619
bio website budo.markcwallace.net
location United States
age 51
visits member for 2 years
seen 3 hours ago

I'm currently studying Tomiki Aikido under Dr. Yoji Kondo, although I started in Yoshinkan aikido under Helton-Sensei. I'm also studying Taiji under D. Gilmer at StillwaterTaichi I'm informally studying jo and bokken.

When I'm not on the mat, I provide project management support to the the Identity, Credential, and Access Management program at a US Federal Cabinet agency, but I want to get back into risk management and computer security/information assurance.


8h
awarded  Electorate
Oct
10
awarded  Yearling
Oct
7
comment How can security audits be integrated into an agile project?
There is truth in what you say, and for a mature security program, I might defer to your advice. But for most of the security programs I have seen, the value in the approach I proposed is that it makes the security analysis explicit. If we fail to incorporate security risk analysis in development, then no amount of tools will prevent the ultimate security failure. If we succeed in defining security "No SQL injection", then we can write a suite of tests that ensure that input is quality checked.
Oct
7
comment How can security audits be integrated into an agile project?
Excellent question. Notionally, same as a use case - write a test case to ensure that whatever implementation strategy I've selected is effective. The rigor of my test cases will be proportional to the risk of the mis-use case.
Oct
6
answered How can security audits be integrated into an agile project?
Sep
30
awarded  Explainer
Sep
24
reviewed No Action Needed openssl ECDHE-RSA… cipher suite selected while using RSA server cert and ECDSA client cert
Sep
24
reviewed No Action Needed Is there an example of a web server that does steganographic watermarking?
Sep
24
reviewed Reviewed Are externally referenced libraries (CDN's) a security issue?
Sep
24
comment Are externally referenced libraries (CDN's) a security issue?
A CDN isn't a "library".
Sep
19
revised How do hackers deploy keyloggers?
The title was substantially and semantically different from the question. I believe I've now aligned them. (How to **USE** a keylogger is different from where and how it is installed)
Sep
19
suggested suggested edit on How do hackers deploy keyloggers?
Sep
17
comment Security of a Random Password
NIST provides both the answers and the methodology to understand the problem and reach your own answers. On the other hand, if you're up against an opponent with rainbow tables, the brute force work is already done.
Sep
16
comment Simple Ciphers to Create Secure Passwords
I think you're falling into the XY trap. What is the problem you need to solve?
Sep
16
reviewed Reviewed Simple Ciphers to Create Secure Passwords
Sep
16
comment Simple Ciphers to Create Secure Passwords
Can one? probably - most passwords also require complexity, and it is unlikely that a shift cipher will generate the resulting complexity. Most users are also going to find that the resulting cipher is too complex. Also most simple ciphers (that can be done unaided by a human) are NOT resilient against cryptanalysis. Ultimately the question rests on how you measure security and what your threat profile looks like.
Sep
16
comment Privacy concerns while traveling with HDDs
IANAL, but it seems rather imprudent to ask random strangers on the internet to assist you in violating the law.
Sep
10
comment What kind of factor is a physical signature?
Depends on how you analyze it. If you do graphology, it could be a biometric factor (inherence). Otherwise it is a policy control, and doesn't fit the multi-factor paradigm.
Sep
4
comment Is information security based entirely on mathematics
False assumption; Information security is far more than encryption. Just as a trivial example, information security includes availability, and encryption doesn't help availability. Even the best encryption in the universe is worthless if the key for the encryption is leaked, and no amount of math will affect whether someone with the key leaks the key.
Aug
29
comment Why should I sign data that's already encrypted?
The clarification to Andrey's answer is valuable in interpreting your question; you might want to move it here.