Reputation
3,075
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
5 17
Newest
 Nice Answer
Impact
~132k people reached

Jan
26
comment Public access to IIS Web server inside company network, for one specific service
@silverpenguin What you're suggesting is a support nightmare and does not fit the need for "a solution that emphasize simplicity and ease of access from the user perspective." I assure you first hand the overwhelming majority of users have no clue how to create/modify and manage a VPN connection on their phone, not to mention that you are now split tunneling with cell carrier networks and wi-fi hotspots.
Jan
26
comment Public access to IIS Web server inside company network, for one specific service
Is this a corporate app or a public app? Will it be available in public app stores?
Jan
26
answered Public access to IIS Web server inside company network, for one specific service
Jan
26
comment Public access to IIS Web server inside company network, for one specific service
I don't see this as the best option. The app should not be considered "trusted". It will be installed on a device that is out of your control. Anything embedded in the app (keys, passwords) is up for grabs. Speaking of, how do you propose password changes to occur? Will he have to push out an app update every time the password is changed for the VPN?
Jan
22
answered How are assets assessed for criticality?
Jan
15
comment Adblock to prevent employees from accidentally clicking malicious ads
Depending upon the vulnerability being exploited, the employees don't actually have to click on anything. Flash exploits come to mind.
Jan
14
comment Why limit internet access while connected to a remote desktop?
@André Borie It not a configuration "issue", it is a configuration decision. His employer has opted to disallow split tunneling.
Jan
7
comment Web application security vulnerability managment
@void_in Thanks. I've updated my answer to reflect that.
Jan
7
revised Web application security vulnerability managment
added 116 characters in body
Jan
7
answered Firewall UDP Packet Source Port 53 Ruleset Bypass
Jan
7
answered Web application security vulnerability managment
Jan
4
awarded  Nice Answer
Dec
22
answered Why would some Windows executables not have a “Digital Signatures” tab?
Nov
15
awarded  Tenacious
Nov
6
comment How to restrict access to the internet for some computers on the network?
What's your budget for solving this problem?
Nov
5
answered Application vs Device - Data encrypted at rest
Nov
1
awarded  Yearling
Oct
20
revised A couple of questions about port scanning
added links for reference
Oct
20
answered A couple of questions about port scanning
Oct
20
comment Web site vulnerability discovery by scanner
@PangSerLark Yes, it will. Today's web application scanners (I have 10+ years of experience with HP Webinspect) are quite sophisticated. If there are URL's in the javascript, it will find them. If you have comments in the code, it will find them. Any and all data in the cookie(s) will be parsed and attacked. All headers will parsed and attacked. All parameters found will be manipulated and attacked. All directories will be probed. There will literally be thousands of requests sent to the web server in an effort to sniff out any and all vulnerabilities.