147 reputation
5
bio website
location
age
visits member for 2 years
seen Oct 24 '12 at 13:33

Feb
27
awarded  Popular Question
Oct
23
comment Using an IPS as an alternative to mod_security
I actually live chatted you guys when I made the OP. Your WAF seems to be a great (although expensive) product. Not sure what our organization is going to do but we might be ordering from you. The sales rep couldn't give me a clear answer but can the virtual appliance be used as a replacement for the hardware appliance as we have pretty beefy hardware laying around. The DOCs seem to state that your VI is more for protecting virtual hosts. I don't see why you couldn't just route traffic through it and use it as a pseudo-hardware appliance which if i had to guess is just a beefy linux box
Oct
22
comment What is the best way of securing a website logon without SSL or preshared keys?
To make it even easier just have the server generate a random number challange, concat with the password, and hash using md5 (yes I know md5 is broken, use SHA if you care). As stated above this won't stop a MITM from modifying the javascript. If you instruct the users to view source all the time then you should be ok
Oct
17
answered Why do people tell me not to use VLANs for security?
Oct
16
comment Using an IPS as an alternative to mod_security
I'm not saying a WAF is an excuse for poor code... It's just another link in the chain. Thanks for the info. Do you have any experience with any of the appliance products such as Barracuda.
Oct
16
revised Using an IPS as an alternative to mod_security
added 39 characters in body
Oct
16
awarded  Editor
Oct
16
revised Using an IPS as an alternative to mod_security
added 43 characters in body
Oct
16
asked Using an IPS as an alternative to mod_security
Oct
16
comment Is it good practice to manually lock down ports on each host
That's part of the plan :), I'm actually playing with it right now. I noticed that there weren't many local configuration checks although nessus does have the ability. For example I do not see a plugin that does not check php.ini to check for things like disabled functions.
Oct
16
comment Is it good practice to manually lock down ports on each host
Thanks. As I mentioned in my previous comment do you know of a good "best practices" security checklist. I know a lot of them are common sense but would like a systematic way of auditing each host that is backed by industry standards.
Oct
16
accepted Is it good practice to manually lock down ports on each host
Oct
16
comment Is it good practice to manually lock down ports on each host
Do you know of a good overall checklist of things such as this (disable unnecessary services, disable ports, etc) just so I can systematically check things off and make sure I'm not missing any?
Oct
16
asked Is it good practice to manually lock down ports on each host
Oct
16
accepted Enterprise IDS - Deployment & Uses
Oct
15
asked Enterprise IDS - Deployment & Uses
Oct
12
awarded  Student
Oct
12
comment Sample vulnerable web apps to test Pentesting platforms
Thanks. I found one called Mutillidae. So Metasploit is an alternative to Nessus? I've seen Nessus plugins that integrate Nessus with Metasploit.
Oct
12
awarded  Scholar
Oct
12
comment Sample vulnerable web apps to test Pentesting platforms
Anything that is simply PHP\MySQL?