377 reputation
114
bio website mikeberggren.com
location California
age 30
visits member for 3 years, 8 months
seen Nov 11 at 23:39

Technology Enthusiast, Gamer, Sci-Fi Addict, and DIY-er in training. =)


Sep
20
comment What certificate attributes can I check to verify if an issuer is correct?
I think I found the answer. Most of the time, you can compare the authority key identifier extension value of a certificate with the subject key identifier extension value of the intermediate/root CA it's directly connected to. They should match.
Jun
25
comment What is the proper terminology for the various SMTP tunnel encryption solutions?
@executifs Sorry if I was unclear. I'm referring to features like TLS_Srv:secure.domain ENCR:112 in sendmail which lets you require a minimum bit strength for a TLS session and defer the message if the other side doesn't have TLS or doesn't meet the minimum requirement. Details here: sendmail.com/sm/open_source/docs/m4/starttls.html
Jun
25
comment What is the proper terminology for the various SMTP tunnel encryption solutions?
@executifs That would make sense if I didn't require the use of STARTTLS when sending to some domains but I don't think it is necessarily appropriate for all use cases of option 1. For example, what if I explicitly require the use of STARTTLS when sending to bob.com?
May
20
comment How do I clearly distinguish between groups of formal and informal models?
Thanks D.W. that makes sense. I'm anticipating I'll be asking more questions in the future and want to make sure I'm clearly expressing myself.
May
18
comment How do I clearly distinguish between groups of formal and informal models?
Hi John. That's exactly what I wanted to know. Would you happen to know if your description is consistent with the CISSP terminology?
May
13
comment What is a practical example of an action that violates the non-interference model?
Thanks John - that's exactly what I was looking for!
May
12
comment What's the difference between an access control method, security model, and security policy?
Thanks Rory (and AviD). As a follow-up question... what should I call models that are referenced by other official models? For example, Bell LaPadula falls under the "Information Flow" model right? Are Bell Lapadula and "information flow" both considered security models?
May
12
comment What kind of IT security applications do you guys run on your laptop/desktop?
+1 for AdBlock Plus. Great addon.
May
5
comment Is it correct to consider audits as exclusively “detective” in nature?
Thanks D.W - that finally clicked. I was just over-thinking things. =)
May
5
comment Is it correct to consider audits as exclusively “detective” in nature?
Thanks Scott. I'll need to think about that some more but it makes more sense now. =)
May
4
comment Is it correct to consider Task Based Access Control as a type of RBAC?
I was afraid you'd say that ;-) It makes since but I'm concerned that ambiguous areas like this will become troublesome during the exam since I won't have an essay field to explain why I chose the answer.
May
3
comment Is it correct to consider Task Based Access Control as a type of RBAC?
Ahhhh interesting. Thanks AviD!
Apr
22
comment Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?
Hi Marcin, this is great example too. Thanks for the additional information. It's quite helpful.
Apr
22
comment Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?
Thanks D.W, this is EXACTLY what I was looking for.
Apr
22
comment Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?
Thanks for the clarification. I'm not a programmer so perhaps that's where my confusion is coming from.
Apr
22
comment Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?
Hi John, thanks for the prompt response! I see your point and I guess it doesn't hurt for something to be more secure. As for why it shouldn't happen, I guess it just doesn't make sense to me for a subject to not be able to "read" the same place that they're "writing" to. How would they know if they're overwriting something? It also seems like it would dilute the purpose of the object. If I'm storing "confidential" information in an object that's really intended to keep "Top Secret" information, I'm reducing it's effectiveness. Perhaps I'm over-thinking this though.