1,574 reputation
212
bio website
location Tulsa, OK
age
visits member for 2 years, 5 months
seen 6 hours ago

15 years enterprise IT / Infosec experience and counting...


6h
comment Kerberos Authentication
I found RogueLynn's explanation to be very helpful. roguelynn.com/words/explain-like-im-5-kerberos
6h
comment Suspicious GET request parameter list ?
Any GET request that isn't part of your expected GET request in accordance with the web application design flow is suspicious. Like Question Overflow said, there are too many to list.
Mar
23
comment Is Clickjacking a real security vulnerability?
One can also log keystrokes via an iframe if framebusting techniques are used.
Mar
22
comment Confused about SSL certificates needed for Windows proxy
I'm confused about why you need a web application proxy? If your goal is to redirect users on port 80 to port 443, a web application proxy is not required for that?
Mar
22
comment Which is first job or certificates
Just an FYI, you're not qualified to take the CISSP exam. You must have a minimum of five years of direct full-time security work experience in two or more of the 10 domains. For all requirements, please review: isc2.org/cissp-professional-experience.aspx
Mar
18
comment Does this image contain secret data?
File seems fishy to me. At best it's bad practice (SEO / Webmaster wise) to have a >3mb file size for a 16x16 icon.
Mar
12
comment In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
It used to be quite common actually to utilize lower grade encryption in mobile or battery powered hardware to reduce CPU cycles and battery consumption. For example, the NintendoDS supported 64bit WEP only for those reasons.
Mar
11
comment proxy servers and restricted work computers
This may or may not work depending upon the OP's employer's VPN solution - at least I haven't had much luck establishing a network level VPN connection inside of a VPN connection.
Mar
5
comment Is plain text over https really a good idea?
POST payload is not logged in the Webserver logs.
Mar
3
comment List of cookie parameter names to identify load balancing mechanism
A10 loadbalancers use a "sto-id" cookie by default, though the administrator can technically name the cookie whatever they want.
Feb
4
comment Is there a “security fail forum / website” with lessons learned?
FailyMonster on Twitter reports on these type of incidents. twitter.com/failymonster
Jan
30
comment Check SSLv3 in Apache Tomcat locally as well as on server on windows/linux
Also keep in mind if your webserver is behind a load balancer that is offloading/inspecting/handling SSL traffic it may be vulnerable.
Jan
29
comment Could someone stop another from accessing their own online account?
I think you meant to say, how would Bob defend himself if Alice had a small team. ;) The best way to mitigate this attack if there is a small team willing to enter captchas would be to enable 2 factor authentication for the account. It's actually very easy to configure and use, and would prevent all the scenarios outlined above from being successful.
Jan
28
comment Someone or something tried to login to my Gmail using IP address of my shared hosting
You can also go to myaccount.google.com From there you can review "Devices" under "Recent Activity". Also, check under "Account Permissions" for "Connected apps and services".
Jan
26
comment SSL mismatch error using ISP-provided IP address but not VPN IP address
Occam's Razor would suggest that Firefox is warning you that autos.yahoo.com is susceptible to POODLE.
Jan
21
comment Security risk with using internal IP on public DNS
It goes against the spirit of RFC 1918. "Indirect references to such addresses should be contained within the enterprise. Prominent examples of such references are DNS Resource Records and other information referring to internal private addresses."
Jan
21
comment Why should I use whitelist on a WAF?
Whitelisting because: "You don't know what you don't know". Think about it.
Jan
13
comment Can I create an SSL certificate on windows signed with the machine's certificate?
Yes, the key exists on your internal Root Certification Authority server. No, you do not have access to it. (at least you shouldn't) Unfortunately I cannot tell you what your IT department is using that certificate for. As a member of a domain it's common to see a workstation have a certificate for authentication purposes, but that resides in the Personal store, not the Root store. The only reason you would see a non Root certificate in the Root store is to suppress certificate warnings.
Jan
13
comment How to protect the company VIPs
BeyondTrust makes a product to help with these types of situations. Search for "PowerBroker for Windows: Privilege and Session Management". And no, I don't work for BT.
Dec
29
comment How does infection through web surfing work?
^^^ That is still entirely possible. Once can be compromised merely by visiting a malicious site depending upon the exploit being leveraged.