1,614 reputation
212
bio website
location Tulsa, OK
age
visits member for 2 years, 5 months
seen 3 hours ago

15 years enterprise IT / Infosec experience and counting...


Dec
29
comment How does infection through web surfing work?
^^^ That is still entirely possible. Once can be compromised merely by visiting a malicious site depending upon the exploit being leveraged.
Dec
24
comment Best practices to copy private keys to mobile devices
Which phone manufacturer?
Dec
19
comment Web server interaction with a database server
I think you may have misunderstood, or perhaps I am not following you. The DMZ is not dual-homed to the public internet and internal network. There are two separate DMZs - A WebDMZ and an AppDMZ. There is no access from the internet directly to the AppDMZ or internal network.
Dec
19
revised Connecting trusted and untrusted networks
added 113 characters in body
Dec
19
answered Web server interaction with a database server
Dec
19
answered Connecting trusted and untrusted networks
Dec
18
comment Multi Domain SSL for different ip?
For future reference, SSL certificates are not tied to IP address, per se. They are tied to the CN or Common Name assigned in the certificate. As long as the target host resolves to the CN you're good.
Dec
18
comment Protect against clickjacking but allow framing on domain?
Any reason why you wouldn't/can't just use the ALLOW-FROM option? From what I've read, current versions IE and Mozilla both support it. Chrome is unconfirmed at this point.
Dec
17
comment Which all ports are in danger and needs to be closed with immediate attention?
Is there a (poorly configured) firewall in front of this webserver?
Dec
16
comment Do website owners know what keywords a visitor typed in google search to get to their site?
Yes, they do. I can tell you for a fact that google webmaster tools displays search queries that lead users to your website.
Dec
16
comment How to exfiltrate data over remote desktop
Ummm.. What about screenshots?
Dec
16
comment How to find processes that are hidden from task manager
I just watched a Webinar last week on this very subject. Check out: vimeo.com/…
Dec
16
answered What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?
Dec
15
revised What kind of SSL certificate do I need?
deleted 2 characters in body
Dec
11
comment Is Changing a File Type and Name an Effective Security Solution?
Something, something, DANGERZONE!
Dec
11
comment Hardware encryption for Flash Drives
Also keep in mind that most hardware based encryption implementations will have a TPM, or trusted platform module. The TPM stores the key(s) used to encrypt/decrypt the data in a physically separate/independent chip from the OS and rest and of the hardware. This makes it exponentially more difficult for an attacker to extract the keys. The problems with software based encryption is that the keys are there, protected by various means, but still stored in software.
Dec
8
comment certificate authentication between apps
It doesn't quite work that way. Please reference the diagram I added to the answer which will hopefully clarify things a bit. The Tomcat server will indeed have a server certificate signed by your corporate CA. The tomcat server will also generate a client side certificate. This client side certificate is what you install/embed within your .net server/application. The tomcat server should be configured to grant access only to users/entities who present a client side certificate issued by the tomcat server.
Dec
8
revised certificate authentication between apps
added 178 characters in body
Dec
8
answered certificate authentication between apps
Dec
8
comment certificate authentication between apps
Are you asking for the the .net app to authenticate to the tomcat app via a client side certificate?