2,468 reputation
315
bio website
location Tulsa, OK
age
visits member for 2 years, 6 months
seen yesterday

15 years enterprise IT / Infosec experience and counting...


May
20
comment Locking access to remote DB from a freely downloadable app (that acces the DB)
And always implement stored procedures when possible. Do not allow raw queries to the DB.
May
19
comment What is risk of having memcache in public interface?
The documentation I've read seems to indicate the application is susceptible to stored cross site scripting versus reflected - in which case social engineering isn't required. Also, please read the article over data ex-filtration. The person was able to extract cached data from mem cache. If any sensitive data was cached (userID's, passwords, connection strings, etc) it could have been compromised.
May
19
comment What is risk of having memcache in public interface?
Is "memcache" and "memcached" the same product?
May
18
comment Threat modelling tools and alternative threats
You might look into "SeaSponge". I haven't used it myself, but it's supposed to be tailored towards SysAdmins.
May
16
comment What can I do as a user to minimize the risk of online banking?
To further Andre's (sorry, don't know how to make the special e) point on the first bullet, technology has emerged that allows infosec personal to either A.) Block Tor users from accessing their websites or B.) Limit the functionality of a Tor user while they are logged into a website. The reasoning is that a typical user does not use Tor, however, nefarious types who want to remain anonymous are more likely to use Tor.
May
15
comment Monitoring Active Directory Domain Administrator Activities
There are companies that offer Advanced Threat Analytics (hint, hint) solutions that may fit your needs. Unfortunately, I cannot recommend a specific vendor.
May
13
comment Security benefits to have IP-filter in HttpModule instead of Page-Load in asp.net pipeline?
FWIW, IP address restrictions can be placed on one page specifically.
May
12
comment Safety of exposing an internal web application to the internet using a reverse proxy in the DMZ
So would it be out of the question to have this site behind a VPN portal, or restrict access to allowed network segments?
May
12
comment Safety of exposing an internal web application to the internet using a reverse proxy in the DMZ
+1 for the Skeletor avatar. Will the users of this system be predefined? In other words, will this application be used by random internet clients, or will it primarily be used by other businesses?
May
6
comment Bring your own phone to a (new) job: Consequences?
I've drawn a couple conclusions myself. Chances are that older people have been working for their employer for decades and so there is more trust. Older people may also be less likely to have apps installed, or use the camera/video recorder. I know several older folks who own smartphones but use them like a standard cell phone. Likewise, younger folks may be more likely to use a multitude of apps from banking to snapchat - and likewise are more likely to engage in promiscuous behavior which could be embarrassing or damaging if discovered by an employer. Just a theory.
Apr
30
comment Someone Copied Our Site Code (Including Analytics) and Put Adult Content on It
Will this filter prevent the OP from being alerted someone has copy/pasted his site?
Apr
23
comment Understanding Certificate Pinning
Kudos for the SSH comparison.
Apr
22
comment How to find out if somebody is spying on my private browsing data in the same WiFi network?
There is no way for you or anyone else to know for sure. We can only make assumptions.
Apr
21
comment How to keep logs safe from attackers?
Sounds like you need a SIEM.
Apr
17
comment Does http.sys vulnerability affect Windows not running any webservers?
Please review: news.ycombinator.com/item?id=9378449
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
One thing to note, if the users have a propensity to click past certificate warnings then the attacker doesn't have to take the DNS down, or force a connection by IP. The attacker can spoof any secured site with a MitM and the user would click passed the warning prompts.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
In that very specific scenario, yes. But I would hope if the user is savvy enough to access the site by IP, I would hope they would be savvy enough to read the warning for the reason "why" the certificate was untrusted when accessing the site by IP. Was it because there was a name mismatch? Was it because the certificate chain was broken? Was it because the CA was untrusted? The latter two would indicate a possible MitM attempt.
Mar
30
comment Kerberos Authentication
I found RogueLynn's explanation to be very helpful. roguelynn.com/words/explain-like-im-5-kerberos
Mar
30
comment Suspicious GET request parameter list?
Any GET request that isn't part of your expected GET request in accordance with the web application design flow is suspicious. Like Question Overflow said, there are too many to list.
Mar
23
comment Is Clickjacking a real security vulnerability?
One can also log keystrokes via an iframe if framebusting techniques are used.