1,013 reputation
18
bio website
location
age
visits member for 1 year, 10 months
seen yesterday

15 years enterprise IT / Infosec experience and counting...


2d
comment Does a separate internet connection increase security for remote users?
"I, myself, have made the same request to a certain remote employee to ensure separation of use within that employee's home." How does this ensure separation? What prevents another user in the home from using this same separate connection? What prevents the user from connecting other devices to this same separate connection? Unless you're also deploying a corporate owned and controlled router at the end point, you haven't really ensured anything except that the employee now has a higher monthly internet bill.
Sep
9
comment How to check whether firewall allows traffic on specific port but not listening on the port
If it's available, use Telnet.
Sep
9
comment What kind of factor is a physical signature?
..I don't know about you guys, but I can't even reproduce my OWN signature identically every time. :D
Sep
5
comment Can eavesdropping be facilitated by injecting content that will be transmitted?
Is the card data at Bank A encrypted at rest?
Sep
5
comment BREACH attack and content length
Isn't BREACH the least of your worries if there is a MITM? I mean, it seems like the requirements in order for this to be effective would leave to you open to much more sinister attacks. What am I missing?
Sep
5
comment Juggling bus factor & separation of duties on a small team?
It sounds like you're at a crossroads. Are you happy with the status quo or do you want to take the business to the next level? With great risk comes great reward. You've reached a point where you need to spend more money to make more money. If the capital is not on hand you may consider taking on some investors or perhaps a loan. Another option may be to hire interns, or find people willing to accept a job offer based on deferred compensation. I don't envy the decision you have to make one bit, that's tough.
Aug
19
comment Basic Website Protection (XSS,SQL-inject,hashing)
Excellent. I think I read too much between the lines and assumed you were using javascript to validate input.
Aug
19
comment Basic Website Protection (XSS,SQL-inject,hashing)
"Also, is having logic on the client a risk?" Huge risk. Never rely on client side filtering (or trust client side input). It's trivial for a malicious user to bypass.
Aug
17
comment Same-origin policy for desktop application?
For starters the website could be susceptible to CSRF or XSS. While this may not cause a permanent compromise, you could still have a very bad day depending upon the payload. For seconders, your statement in the question above doesn't specify "unless there is a vulnerability in the browser or extension/plugins" - Which is my whole point. It's very misleading. Someone may read that and think they are safe, when they are in fact, not. The entire statement I quoted in my first comment is inaccurate and misleading and needs to be revised.
Aug
16
comment Same-origin policy for desktop application?
No, no you are NOT safe, in general or otherwise when visiting a malicious website! Sandboxing is irrelevant.
Aug
15
comment internal proxy server vs DMZ proxy server
Are you referring to a reverse proxy server?
Aug
15
comment Same-origin policy for desktop application?
This statement is not accurate: "Currently, if you visit a malicious website, for example a website impersonating google, you are not compromised forever. When you leave the malicious website, you are fine again. If you didn't do anything dangerous on it, such as typing your google login information, then nothing bad happened to you." One can be persistently compromised by merely VISITING a malicious site once, without even having clicked anything.
Aug
12
comment Several processes are listening to the same interface: any problem?
In other words.... imgflip.com/i/b30pu
Jul
11
comment What should you do when you notice weird traffic?
"My personal server gets portscanned, dirbustered, etc., multiple times a day. I don't even blink at those reports, it's just noise at this point." +1 To this statement. This sort of thing happens on a continual basis. You will put yourself into an early grave if you try to proactively investigate and block every person who scans your network.
Jul
9
comment When is it appropriate to provide clickjacking protection one of my websites pages?
Just wanted to add that not all browsers support the X-Frame option. If you're concerned with protecting users with older browsers you need to include frame busting java script on the pages you want to protect.
Jul
8
comment How did my network admin identify my iPhone and how can I hide my ID?
You need to remember that while it may be "my personal phone" it is your COMPANY'S network. You are using their bandwidth.
Jul
7
comment If an ATM is stolen, how easy can the personal information of the users be recovered?
It's called an "Encrypted Pin Pad", or EPP for short. Source: diebold.com/Diebold%20Asset%20Library/…
Jun
30
comment How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
I've always liked this explanation. Much easier to grasp than a bunch of math equations.
Jun
29
comment How can clicking a link in a Facebook users news feed compromise their account
Just know this; merely clicking the wrong link can cause you to get completely owned. The internet is a very dangerous place. Zero Day exploits can exist long before the public is aware. The worst of these allow your machine to be compromised simply by clicking a malicious link. Never take candy from a suspicious looking link. Never take a ride with a suspicious looking link. Does this sound familiar? It's the same thing our parents taught us as kids. Links are strangers. Strangers are dangerous. Beware the stranger danger!
May
27
comment How Safe Are Encrypted Websites Really?
Do tell, what behavior made him look "as if he was doing something suspicious on his computer as far as hacking/networking".