1,389 reputation
211
bio website k1DBLITZ.com
location Tulsa, OK
age
visits member for 2 years, 1 month
seen Dec 24 at 17:39

15 years enterprise IT / Infosec experience and counting...

Professional Kickboxer/Boxer and avid PC gamer. (weird combination, I know)


Dec
24
comment Best practices to copy private keys to mobile devices
Which phone manufacturer?
Dec
19
comment Securing my website and making it Internal use only. Only open to specific usernames/pass
I would exercise caution. It sounds like you there will be company specific URL's, applications, etc in these videos. You could find yourself in hotwater with IT/Infosec policies by hosting this information on a public server.
Dec
19
comment Web server interaction with a database server
I think you may have misunderstood, or perhaps I am not following you. The DMZ is not dual-homed to the public internet and internal network. There are two separate DMZs - A WebDMZ and an AppDMZ. There is no access from the internet directly to the AppDMZ or internal network.
Dec
18
comment Multi Domain SSL for different ip?
For future reference, SSL certificates are not tied to IP address, per se. They are tied to the CN or Common Name assigned in the certificate. As long as the target host resolves to the CN you're good.
Dec
18
comment Protect against clickjacking but allow framing on domain?
Any reason why you wouldn't/can't just use the ALLOW-FROM option? From what I've read, current versions IE and Mozilla both support it. Chrome is unconfirmed at this point.
Dec
17
comment Which all ports are in danger and needs to be closed with immediate attention?
Is there a (poorly configured) firewall in front of this webserver?
Dec
16
comment Do website owners know what keywords a visitor typed in google search to get to their site?
Yes, they do. I can tell you for a fact that google webmaster tools displays search queries that lead users to your website.
Dec
16
comment How to exfiltrate data over remote desktop
Ummm.. What about screenshots?
Dec
16
comment How to find processes that are hidden from task manager
I just watched a Webinar last week on this very subject. Check out: vimeo.com/…
Dec
11
comment Is Changing a File Type and Name an Effective Security Solution?
Something, something, DANGERZONE!
Dec
11
comment Hardware encryption for Flash Drives
Also keep in mind that most hardware based encryption implementations will have a TPM, or trusted platform module. The TPM stores the key(s) used to encrypt/decrypt the data in a physically separate/independent chip from the OS and rest and of the hardware. This makes it exponentially more difficult for an attacker to extract the keys. The problems with software based encryption is that the keys are there, protected by various means, but still stored in software.
Dec
8
comment certificate authentication between apps
It doesn't quite work that way. Please reference the diagram I added to the answer which will hopefully clarify things a bit. The Tomcat server will indeed have a server certificate signed by your corporate CA. The tomcat server will also generate a client side certificate. This client side certificate is what you install/embed within your .net server/application. The tomcat server should be configured to grant access only to users/entities who present a client side certificate issued by the tomcat server.
Dec
8
comment certificate authentication between apps
Are you asking for the the .net app to authenticate to the tomcat app via a client side certificate?
Dec
5
comment What do I do when an ATM freezes
Sounds like some wal-mart employee just conned you out of $800.
Nov
28
comment How do you explain to experts that a database server should not reside in the DMZ?
For more information on this topic in the future (in case you need more ammo) the term is "N Tiered Architecture". (for google searches)
Nov
27
comment What happens if a page with an invalid SSL cert responds with a 302 redirect to a page with a valid cert? Do you still get the warning?
This is a common problem that can occur if a site is hosted entirely in SSL. Buying an SSL certificate with a SAN (subject alternative name) will get around this problem. Entrust offers one SAN "free" with each of their certificates. Not sure about the other vendors.
Nov
25
comment “Diffie-Hellman Key Exchange” in plain English
In the case of an HTTPS connection, authentication is handled by the SSL certificate framework. You can be certain (as you can be) that you are communicating with the intended parties through verification and trust. The handshake/negotiation of an SSL connection is expensive in terms of overhead. The DH algorithm allows both parties to securely negotiate a symmetric key for encryption/decryption which is much more efficient.
Nov
24
comment Can a botnet be used to effectively break encryption keys?
Fun Fact: the Titan supercomputer employs 18,688 NVIDIA Tesla K20 GPUs in conjunction with CPUs. I wonder if the 'secure' assumption included the exponentially superior performance of GPUs when performing such operations?
Oct
30
comment Can anyone be hacked?
Wow...dude... you went off the deep end. :) Schroeder's response is obviously coming from a real world corporate background - at least that's what I'm seeing in his response.
Sep
30
comment Internal IP addresses allowed access to all DMZ hosts
Correct. In my opinion, the chance of a workstation being compromised by an outside attacker is exponentially higher than a server being compromised by an outside attacker. Workstations are operated by users who have a propensity to click things, have some form of direct internet access, and tend to use highly vulnerable programs like Flash or AdobePDFs. That attack surface of a workstation is greater than that of a server. This means the internal workstations cannot be assumed trusted from a DMZ point of view and should not have unrestricted / unfiltered access to DMZ assets.