Reputation
3,135
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
6 18
Newest
 Enlightened
Impact
~152k people reached

Jan
26
comment Public access to IIS Web server inside company network, for one specific service
@silverpenguin What you're suggesting is a support nightmare and does not fit the need for "a solution that emphasize simplicity and ease of access from the user perspective." I assure you first hand the overwhelming majority of users have no clue how to create/modify and manage a VPN connection on their phone, not to mention that you are now split tunneling with cell carrier networks and wi-fi hotspots.
Jan
26
comment Public access to IIS Web server inside company network, for one specific service
Is this a corporate app or a public app? Will it be available in public app stores?
Jan
26
comment Public access to IIS Web server inside company network, for one specific service
I don't see this as the best option. The app should not be considered "trusted". It will be installed on a device that is out of your control. Anything embedded in the app (keys, passwords) is up for grabs. Speaking of, how do you propose password changes to occur? Will he have to push out an app update every time the password is changed for the VPN?
Jan
15
comment Adblock to prevent employees from accidentally clicking malicious ads
Depending upon the vulnerability being exploited, the employees don't actually have to click on anything. Flash exploits come to mind.
Jan
14
comment Why limit internet access while connected to a remote desktop?
@André Borie It not a configuration "issue", it is a configuration decision. His employer has opted to disallow split tunneling.
Jan
7
comment Web application security vulnerability managment
@void_in Thanks. I've updated my answer to reflect that.
Nov
6
comment How to restrict access to the internet for some computers on the network?
What's your budget for solving this problem?
Oct
20
comment Web site vulnerability discovery by scanner
@PangSerLark Yes, it will. Today's web application scanners (I have 10+ years of experience with HP Webinspect) are quite sophisticated. If there are URL's in the javascript, it will find them. If you have comments in the code, it will find them. Any and all data in the cookie(s) will be parsed and attacked. All headers will parsed and attacked. All parameters found will be manipulated and attacked. All directories will be probed. There will literally be thousands of requests sent to the web server in an effort to sniff out any and all vulnerabilities.
Oct
16
comment What is a typical response from webserver for POST request?
@DoodleKana Correct, the HTTP status code is irrelevant. There is a distinction between Post data and form field data. Post payload is not cached but form field data can be cached. To prevent form field data from being cached, please refer to stackoverflow.com/questions/2699284/…
Oct
14
comment Pros and cons of security images
Actually, many institutions have removed site images due to pending litigation by patent trolls.
Oct
13
comment Can a WiFi access point operator tell that I'm streaming video to my phone?
@drxzcl "Netflix is on the harmless end of the scale" This is not entirely true. There are other factors to consider. We don't know if any business critical processes are using the Wi-Fi. We don't know how much bandwidth is available via the Wi-Fi link. A situation could occur where the link is saturated with streaming Netflix traffic if other employees adopted this same approach to combat boredom, creating a DOS scenario.
Oct
6
comment Is it possible to change code of website through an embedded image
In addition to what Dr Mattle said, "The little jpeg that could hack your organization" youtube.com/watch?v=BIwe571zcWY A real world example of why it's important to get this right.
Oct
5
comment Non-Sensitive/Non-Critical Database and Web server protections?
"People confirmers" are commonly referred to as Captchas. :) As for the webserver, ideally there would be a WAF (web application firewall) or HIDS (host based IDS) in place to help prevent and detect attacks. In this case though, it seems the cost to implement would be higher than the data worth protecting. It would serve the security posture well if the developers are following OWASP and SANS SWAT guidelines for secure coding.
Oct
1
comment Non-Sensitive/Non-Critical Database and Web server protections?
Can you define/elaborate on "gets interfaces from two critical systems"?
Sep
24
comment How do banking software systems securely store account information in database?
Also, companies like Imperva and McAfee have products designed to detect as well as prevent this type of scenario from occurring. These products are dubbed "Database Activity Monitoring" - aka: DAM.
Sep
23
comment Implications of the security model of HTTP cookies on HTTPS connections
The HttpOnly flag is designed to help prevent scripts from interacting with a cookie.
Sep
10
comment Many suspicious requests are going from my browser whenever open any site
In the meantime, you can redirect those sites to 0.0.0.0 via your hosts files until you can get things under control.
Sep
8
comment Browsing file/directory structure of a website
In IIS, it's a server side configuration. Directory Browsing can be enabled or disabled.
Aug
24
comment What is the proper setup procedure for SSL Tunnel certificates?
Just a hunch.... but Niagara use a Java framework if I'm not mistaken. Which means it's likely this subsystem that fails to work is using the Java Keystore, which will not contain the trusted root of the customers CA. Combining the cert chain is a workaround. You might try going down the path of importing the customer's root into the java keystore.... or.. it may end up being a waste of time. :) Sorry, I have no direct experience with Niagara.
Aug
20
comment Why do we still use keys to start cars? why not passwords?
Parking lot predators would vote for a combination lock. It would keep their victims distracted longer.