1,574 reputation
212
bio website
location Tulsa, OK
age
visits member for 2 years, 5 months
seen 2 days ago

15 years enterprise IT / Infosec experience and counting...


Dec
16
answered What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?
Dec
15
revised What kind of SSL certificate do I need?
deleted 2 characters in body
Dec
11
comment Is Changing a File Type and Name an Effective Security Solution?
Something, something, DANGERZONE!
Dec
11
comment Hardware encryption for Flash Drives
Also keep in mind that most hardware based encryption implementations will have a TPM, or trusted platform module. The TPM stores the key(s) used to encrypt/decrypt the data in a physically separate/independent chip from the OS and rest and of the hardware. This makes it exponentially more difficult for an attacker to extract the keys. The problems with software based encryption is that the keys are there, protected by various means, but still stored in software.
Dec
8
comment certificate authentication between apps
It doesn't quite work that way. Please reference the diagram I added to the answer which will hopefully clarify things a bit. The Tomcat server will indeed have a server certificate signed by your corporate CA. The tomcat server will also generate a client side certificate. This client side certificate is what you install/embed within your .net server/application. The tomcat server should be configured to grant access only to users/entities who present a client side certificate issued by the tomcat server.
Dec
8
revised certificate authentication between apps
added 178 characters in body
Dec
8
answered certificate authentication between apps
Dec
8
comment certificate authentication between apps
Are you asking for the the .net app to authenticate to the tomcat app via a client side certificate?
Dec
5
answered What kind of SSL certificate do I need?
Dec
5
comment What do I do when an ATM freezes
Sounds like some wal-mart employee just conned you out of $800.
Dec
3
revised Do firewall rules have to be symmetric? That is, does a firewall have to block a particular traffic type both inbound and outbound
added 4 characters in body
Dec
3
answered Do firewall rules have to be symmetric? That is, does a firewall have to block a particular traffic type both inbound and outbound
Dec
2
awarded  Student
Dec
2
asked Can I force unique passwords for domain admin accounts?
Nov
28
answered W3af and automated vulnerability scanners vs manual testing
Nov
28
comment How do you explain to experts that a database server should not reside in the DMZ?
For more information on this topic in the future (in case you need more ammo) the term is "N Tiered Architecture". (for google searches)
Nov
27
comment What happens if a page with an invalid SSL cert responds with a 302 redirect to a page with a valid cert? Do you still get the warning?
This is a common problem that can occur if a site is hosted entirely in SSL. Buying an SSL certificate with a SAN (subject alternative name) will get around this problem. Entrust offers one SAN "free" with each of their certificates. Not sure about the other vendors.
Nov
25
comment “Diffie-Hellman Key Exchange” in plain English
In the case of an HTTPS connection, authentication is handled by the SSL certificate framework. You can be certain (as you can be) that you are communicating with the intended parties through verification and trust. The handshake/negotiation of an SSL connection is expensive in terms of overhead. The DH algorithm allows both parties to securely negotiate a symmetric key for encryption/decryption which is much more efficient.
Nov
24
comment Can a botnet be used to effectively break encryption keys?
Fun Fact: the Titan supercomputer employs 18,688 NVIDIA Tesla K20 GPUs in conjunction with CPUs. I wonder if the 'secure' assumption included the exponentially superior performance of GPUs when performing such operations?
Nov
1
awarded  Yearling