Reputation
607
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
8 21
Newest
 Yearling
Impact
~18k people reached

  • 0 posts edited
  • 1 helpful flag
  • 89 votes cast
Jul
25
comment What exactly is IE / Chrome checking when I view the “certification path” tab on cert connection details?
So I take that to mean that alerts highlighting serious flaws in the trust are based off of the actual cert chain in the TLS session and aren't susceptible to false positives based on the user's local trust store?
Jul
25
comment What exactly is IE / Chrome checking when I view the “certification path” tab on cert connection details?
Thanks. I think that answers my question. I'm confused though: if the browser certificate view isn't necessarily showing me 100% accurate information about the cert chain it received during the actual connection, what's the point of it? How can I know if certificate issues/errors are a result of missing/incorrect local store information... or a server side issue?
Jul
25
comment What exactly is IE / Chrome checking when I view the “certification path” tab on cert connection details?
Thank you for the detailed response however my question wasn't regarding how TLS works. I want to understand why the certification path section of the crypto shell extension view can-be/is specifically different (and why).
Apr
29
comment What is the relationship between “SHA-2” and “SHA-256”
@D.W. Apologies. My prior understanding was indeed based on review of the wikipedia article (and general "Googling") however I wasn't certain how accurate it was. I'll keep this in mind for future questions and endeavor to make things more clear.
Sep
20
comment What certificate attributes can I check to verify if an issuer is correct?
I think I found the answer. Most of the time, you can compare the authority key identifier extension value of a certificate with the subject key identifier extension value of the intermediate/root CA it's directly connected to. They should match.
Jun
25
comment What is the proper terminology for the various SMTP tunnel encryption solutions?
@executifs Sorry if I was unclear. I'm referring to features like TLS_Srv:secure.domain ENCR:112 in sendmail which lets you require a minimum bit strength for a TLS session and defer the message if the other side doesn't have TLS or doesn't meet the minimum requirement. Details here: sendmail.com/sm/open_source/docs/m4/starttls.html
Jun
25
comment What is the proper terminology for the various SMTP tunnel encryption solutions?
@executifs That would make sense if I didn't require the use of STARTTLS when sending to some domains but I don't think it is necessarily appropriate for all use cases of option 1. For example, what if I explicitly require the use of STARTTLS when sending to bob.com?
May
20
comment How do I clearly distinguish between groups of formal and informal models?
Thanks D.W. that makes sense. I'm anticipating I'll be asking more questions in the future and want to make sure I'm clearly expressing myself.
May
18
comment How do I clearly distinguish between groups of formal and informal models?
Hi John. That's exactly what I wanted to know. Would you happen to know if your description is consistent with the CISSP terminology?
May
13
comment What is a practical example of an action that violates the non-interference model?
Thanks John - that's exactly what I was looking for!
May
12
comment What's the difference between an access control method, security model, and security policy?
Thanks Rory (and AviD). As a follow-up question... what should I call models that are referenced by other official models? For example, Bell LaPadula falls under the "Information Flow" model right? Are Bell Lapadula and "information flow" both considered security models?
May
12
comment What kind of IT security applications do you guys run on your laptop/desktop?
+1 for AdBlock Plus. Great addon.
May
5
comment Is it correct to consider audits as exclusively “detective” in nature?
Thanks D.W - that finally clicked. I was just over-thinking things. =)
May
5
comment Is it correct to consider audits as exclusively “detective” in nature?
Thanks Scott. I'll need to think about that some more but it makes more sense now. =)
May
4
comment Is it correct to consider Task Based Access Control as a type of RBAC?
I was afraid you'd say that ;-) It makes since but I'm concerned that ambiguous areas like this will become troublesome during the exam since I won't have an essay field to explain why I chose the answer.
May
3
comment Is it correct to consider Task Based Access Control as a type of RBAC?
Ahhhh interesting. Thanks AviD!
Apr
22
comment Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?
Hi Marcin, this is great example too. Thanks for the additional information. It's quite helpful.
Apr
22
comment Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?
Thanks D.W, this is EXACTLY what I was looking for.
Apr
22
comment Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?
Thanks for the clarification. I'm not a programmer so perhaps that's where my confusion is coming from.
Apr
22
comment Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?
Hi John, thanks for the prompt response! I see your point and I guess it doesn't hurt for something to be more secure. As for why it shouldn't happen, I guess it just doesn't make sense to me for a subject to not be able to "read" the same place that they're "writing" to. How would they know if they're overwriting something? It also seems like it would dilute the purpose of the object. If I'm storing "confidential" information in an object that's really intended to keep "Top Secret" information, I'm reducing it's effectiveness. Perhaps I'm over-thinking this though.