meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 7 months |
| seen | Oct 24 '12 at 13:33 | |
| stats | profile views | 3 |
|
Oct 23 |
comment |
Using an IPS as an alternative to mod_security I actually live chatted you guys when I made the OP. Your WAF seems to be a great (although expensive) product. Not sure what our organization is going to do but we might be ordering from you. The sales rep couldn't give me a clear answer but can the virtual appliance be used as a replacement for the hardware appliance as we have pretty beefy hardware laying around. The DOCs seem to state that your VI is more for protecting virtual hosts. I don't see why you couldn't just route traffic through it and use it as a pseudo-hardware appliance which if i had to guess is just a beefy linux box |
|
Oct 22 |
comment |
What is the best way of securing a website logon without SSL or preshared keys? To make it even easier just have the server generate a random number challange, concat with the password, and hash using md5 (yes I know md5 is broken, use SHA if you care). As stated above this won't stop a MITM from modifying the javascript. If you instruct the users to view source all the time then you should be ok |
|
Oct 17 |
answered | Why do people tell me not to use VLANs for security? |
|
Oct 16 |
comment |
Using an IPS as an alternative to mod_security I'm not saying a WAF is an excuse for poor code... It's just another link in the chain. Thanks for the info. Do you have any experience with any of the appliance products such as Barracuda. |
|
Oct 16 |
revised |
Using an IPS as an alternative to mod_security added 39 characters in body |
|
Oct 16 |
awarded | Editor |
|
Oct 16 |
revised |
Using an IPS as an alternative to mod_security added 43 characters in body |
|
Oct 16 |
asked | Using an IPS as an alternative to mod_security |
|
Oct 16 |
comment |
Is it good practice to manually lock down ports on each host That's part of the plan :), I'm actually playing with it right now. I noticed that there weren't many local configuration checks although nessus does have the ability. For example I do not see a plugin that does not check php.ini to check for things like disabled functions. |
|
Oct 16 |
comment |
Is it good practice to manually lock down ports on each host Thanks. As I mentioned in my previous comment do you know of a good "best practices" security checklist. I know a lot of them are common sense but would like a systematic way of auditing each host that is backed by industry standards. |
|
Oct 16 |
accepted | Is it good practice to manually lock down ports on each host |
|
Oct 16 |
comment |
Is it good practice to manually lock down ports on each host Do you know of a good overall checklist of things such as this (disable unnecessary services, disable ports, etc) just so I can systematically check things off and make sure I'm not missing any? |
|
Oct 16 |
asked | Is it good practice to manually lock down ports on each host |
|
Oct 16 |
accepted | Enterprise IDS - Deployment & Uses |
|
Oct 15 |
asked | Enterprise IDS - Deployment & Uses |
|
Oct 12 |
awarded | Student |
|
Oct 12 |
comment |
Sample vulnerable web apps to test Pentesting platforms Thanks. I found one called Mutillidae. So Metasploit is an alternative to Nessus? I've seen Nessus plugins that integrate Nessus with Metasploit. |
|
Oct 12 |
awarded | Scholar |
|
Oct 12 |
comment |
Sample vulnerable web apps to test Pentesting platforms Anything that is simply PHP\MySQL? |
|
Oct 12 |
accepted | Sample vulnerable web apps to test Pentesting platforms |
