390 reputation
14
bio website
location
age
visits member for 1 year, 9 months
seen Jan 29 at 18:38

Mar
7
awarded  Yearling
Jan
29
answered Why is no cloud allowed in this brief?
Jan
29
comment ISO27000 implementation - Where do you get the standardization material?
ISO27001, the most important one for security which actually lists the requirements, isn't there.
Jan
29
answered My home PC was hacked and accessed my bank! Advice on next steps?
Jan
22
answered Is sqlmap tracable?
Jan
14
comment Protect our payroll data from a legal and moral obligation
There are a vast number of security controls that could and should be implemented here. To try to enumerate them all is pointless and bound to be woefully incomplete. I think the other two answers provide better advice.
Jan
14
answered Protect our payroll data from a legal and moral obligation
Jan
14
awarded  Nice Answer
Jan
11
answered Can ISPs log IP connections?
Jan
10
awarded  Critic
Jan
10
comment PCI-DSS and salt storage
The salt is there to make rainbow table attacks impossible. The salt has nothing to do with the slowness factor. You should be using a slow (bcrypt or the like) hash regardless. Slow is also relative: You are very unlikely to be processing transactions anywhere near the frequency an attacker will be trying to brute force or dictionary attack the hash.
Jan
10
answered Credit card information being sent over HTTP?
Dec
18
comment PCI DSS 2.0 and ssh keys
> I know the real answer to the auditor. I'm not sure what you mean by this. Which PCI requirement (need a number) is the auditing trying to meet here? And what risk is the risk the auditor is trying to mitigate? I agree that having to enter a password is a hassle. I consider ssh pubkey auth plus a password for the encrypted private key to be 2fa and better than having just a password. Is he wanting you to require key auth and password auth via LDAP on your internal servers?
May
12
answered How can I block an IP, if I'm getting many http requests in a second?
May
12
comment Disk Erasing Security - Odd Number of Writes
The paper cited above is out of date. The 35 passes was arrived at by careful calculation based on drive technology of the 1980's. For any drive made in the last 15 years a single overwrite is enough.
May
12
answered How can I punish a hacker?
May
10
answered any reason not to run tmux/wemux on a bastion host?
May
8
answered Are any and all software vendors who have stored credit card information in their databases subject to PCI-DSS or only some?
May
8
comment Self Tests for cPanel Server PCI Compliance
None of the tools you mention have anything to do with testing against PCI. Download the requirements, such as SAQ-D, read them, and let me know how any of the above tools address any of the requirements. At best they might be used by an ASV (Approved Scanning Vendor) as part of an assessment.
May
8
answered Self Tests for cPanel Server PCI Compliance