1,956 reputation
1619
bio website budo.markcwallace.net
location United States
age 52
visits member for 2 years, 1 month
seen 19 mins ago

I'm currently studying Tomiki Aikido under Dr. Yoji Kondo, although I started in Yoshinkan aikido under Helton-Sensei. I'm also studying Taiji under D. Gilmer at StillwaterTaichi I'm informally studying jo and bokken.

When I'm not on the mat, I provide project management support to the the Identity, Credential, and Access Management program at a US Federal Cabinet agency, but I want to get back into risk management and computer security/information assurance.


2d
revised How does WebID fit in the SAML picture?
wikified reference.
2d
suggested suggested edit on How does WebID fit in the SAML picture?
Nov
19
revised Is storing CVV compliant with PCI standards?
this isn't a question about "legal", it is a question about compliance.
Nov
19
suggested suggested edit on Is storing CVV compliant with PCI standards?
Nov
11
comment How are 1x1 pixel images used in a malicious context?
tracking.
Oct
31
revised Reverse shell back door
Corrected spelling. (Bellow is a loud yell; below indicates direction.)
Oct
31
suggested suggested edit on Reverse shell back door
Oct
31
comment encryption using two keys
Research key splitting.
Oct
24
comment Does the US government protect its physical internet lines in the US?
I feel the comment stream has become too complex and too detailed; my point is that OP's risk model is flawed - (a) you don't need to dig up a transmission line to do a MITM and (b) physical transmission lines are owned and secured by independent entities.
Oct
24
comment Does the US government protect its physical internet lines in the US?
Majority of traffic is mobile. Note that the % isn't really relevant to the point I'm trying to make - that the US government doesn't operate the fiber.
Oct
24
comment Does the US government protect its physical internet lines in the US?
Why would the US government monitor lines owned and operated by private corporations? And why would anyone monitor physical lines when the majority of internet traffic is sent over cell towers?
Oct
23
comment Why require new users to change password?
The user, and only the user, should be uniquely and wholly responsible for any action taken with that userID. If you know the password, you share responsibility if that account is used (for example) to commit a felony (or merely to sexually harass the office cat).
Oct
23
comment Why require new users to change password?
Not to mention the most frequent implementation I've seen involves the admin assigning the same new password to every new user. Which means the adversary has a huge crib for password guessing.
Oct
21
awarded  Electorate
Oct
10
awarded  Yearling
Oct
7
comment How can security audits be integrated into an agile project?
There is truth in what you say, and for a mature security program, I might defer to your advice. But for most of the security programs I have seen, the value in the approach I proposed is that it makes the security analysis explicit. If we fail to incorporate security risk analysis in development, then no amount of tools will prevent the ultimate security failure. If we succeed in defining security "No SQL injection", then we can write a suite of tests that ensure that input is quality checked.
Oct
7
comment How can security audits be integrated into an agile project?
Excellent question. Notionally, same as a use case - write a test case to ensure that whatever implementation strategy I've selected is effective. The rigor of my test cases will be proportional to the risk of the mis-use case.
Oct
6
answered How can security audits be integrated into an agile project?
Sep
30
awarded  Explainer
Sep
24
reviewed No Action Needed openssl ECDHE-RSA… cipher suite selected while using RSA server cert and ECDSA client cert