583 reputation
16
bio website blog.k1DBLITZ.com
location
age
visits member for 1 year, 5 months
seen yesterday

Apr
8
comment X-FRAME-HEADER Options not showing in Firefox
Can you rephrase the question? I don't understand what you are asking.
Apr
1
comment IDS in combination with vulnerability scanner
Just to clarify, there is a difference between configuring the IDS to block alerts, and whitelisting the IP so that the attacks go through. You definitely want to perform the latter. The former if the alerts become overwhelming.
Mar
7
comment Make firewall management public?
However, Web servers/applications on the other hand are notorious for merely being secure for a point in time. There's always another java/php/.net/Apache/IIS exploit right around the corner, and those are only the ones that are publicly discovered and/or divulged. If you or anyone else is comfortable with that risk, that's your/their prerogative. I'm not comfortable taking that risk for something as critical as the Firewall. :)
Mar
7
comment Make firewall management public?
A VPN provides another layer of protection that ideally would use a physical token in addition to a password for authentication. I rarely, if ever have seen vulnerabilities surface that allow an attacker to exploit a VPN platform to gain unauthorized access. Usually it's an userID/password compromise.
Feb
14
comment Why can't someone break email or https encryption by somehow getting access to the encryption key?
Thank you, that has to be one of the best explanations I've read yet. (the gift sending analogy)
Feb
5
comment SSL Handshake failed
My vote is for bullet point number one. Check to make sure the proper intermediate/root certificates exist on the clients that are failing to connect.
Dec
18
comment Does HTTPS encryption work when there is invalid or there is no certificate?
@Adnan You're taking the context or "spirit" of the OP's question out of context for the sake of being "right". The OP's question was clearly in regards to certificates. The method you are describing is not practical for a publicly facing webserver in which anonymous/random users would need access. To my knowledge, IIS does not support RFC4279.
Nov
26
comment How to secure and limit access to a web based application hosted on a local server
Is the web server running IIS? Are you on a domain?
Oct
25
comment Safe to expose Active Directory via LDAPS externally?
One thing to consider, how are you going to stop nefarious users from brute forcing LDAP passwords? How are you going to prevent accounts from being locked out remotely if a malicious user stumbles across this exposed LDAP service?
Jul
11
comment SSL with GET and POST
Just wanted to point out that if you're using GETs to pass credentials (regardless if you're using SSL) that the passwords will be stored in plain text in the Web server logs.
May
14
comment Somehow unexpectedly my computer got infected with malware
@roxyfm - I recommend Qualys Browser Check to make sure your plugins/extensions aren't leaving you vulnerable. I would also run Secunia PSI and make sure all your programs are up to date. If you really want to take it to the next level, download the community versions of RetinaCS by BeyondTrust or Nexpose by Rapid7.
Apr
26
comment Is it safe to allow users multiple login at different browsers & computers?
Keep in mind that gmail also tracks these logins and the user can view this history at any time, which includes Access Type, Location (IP address) and Date/Time stamps. The user also has the ability to sign out all other sessions. The user has the option to be alerted when unusual login activity is occurring. Does your application provide this functionality? Because if not, than they can't use gmail as an example to justify multiple multiple logins.
Apr
15
comment For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?
Odd, from my experiences if the client has the proper chain then you're good to go. Is the java client on a windows machine or unix machine? Java doesn't take advantage of the windows key/certificate store, it has its own. I'm assuming the java client is connecting via and can resolve the CN on the certificate issued to the web service, yes?
Apr
15
comment get vs post which is more secure?
In supplement to your answer, here is a nice table that outlines the differences between both: diffen.com/difference/Get_vs_Post
Apr
15
comment Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
Best TL;DR quote ever. I think I need to create a new stack in my evernote just for your answers. Do you author any articles or books by chance?
Apr
15
comment For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?
Is updating the java certificate store of the java client with the proper intermediate/root certificate out of the question?
Apr
12
comment Firewall philosophy
Nope, it doesn't. Pretty neat how it works. Websense integrates with your corporate internal Certificate Authority to generate certificates on the fly for SSL enabled domains. Since your browser will trust the certs issued from your own CA and the common name matches the connection is trusted. If you view the cert path when connecting via SSL you will see it resolves to your internal CA's root. Also keep in mind that browsers are bound to a different protocol specification when communicating with proxies.
Apr
12
comment Firewall philosophy
@schroder /facepalm It appears we shall agree to disagree.
Apr
11
comment Firewall philosophy
@schroeder No sir, I think it is you who are still missing the point. ;) Two scenarios were outlined above where "blindly blocking" at the firewall is key to preventing and controlling unwanted traffic. Only the proxy server should have access out on port 80 and 443 via fw policy. Only the mail server should have access out on port 25 via fw policy. The firewall is key to creating egress points where the respective applications should be filtering out the unwanted and dangerous traffic. I can outline many scenarios where blacklisting leaves a network vulnerable, but there is a character limit.
Apr
10
comment Firewall philosophy
@droope Websense does it out of the box. The traffic is decrypted, inspected, then re-encrypted before passing it back to the user. This effectively thwarts the OP's scenario.