36,258 reputation
1485155
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 7 months
seen 1 hour ago

Security expert and experienced Windows programmer


May
4
comment Books on Cryptography, with a focus on application to Network Security?
My point was that you'd probably be better off learning about hmac, md5, etc, even SSL, from a crypto book, not a network security book.
May
4
answered ip-fragmentation and mod_security?
May
4
revised ip-fragmentation and mod_security?
edited tags
May
4
comment Is it correct to consider Task Based Access Control as a type of RBAC?
But getting past the test, these considerations - like most other issues - are a tradeoff. What makes sense in your context? What is more "natural" for the users / administrators? What type of application is it, and what is the org's culture? Who are the users - IT folk, or "business" types? And so on...
May
4
comment Is it correct to consider Task Based Access Control as a type of RBAC?
@Mikey sorry to say but (unless they changed it in the last few years) the CISSP exam is unlikely to require that level of analysis and role modeling, just to be familiar with the terms (and what they mean, what they're used for, etc). To be clear, until proven otherwise, I doubt that "Task Based AC" is going to be one of the terms, it will just be "RBAC".
May
3
comment Biometric authentication in the real world
@Rory as I often say, this site does not need to be purely technical - there is a lot of room for "risk analysis / management" type questions. As such, it makes a lot of sense to look at airports as a large system, that needs to be risk-managed. There is a lot in common - just ask @Schneier... ;)
May
3
comment Biometric authentication in the real world
Very good point. Alternatively, it is possible to use it as identification (it's used by police departments all the time), but then it is only id, and not authentication.
May
3
comment Biometric authentication in the real world
@Rory aah yeaah... join the club. Anytime I travel my wife is worried I'm gonna get myself locked up... But really, we should get some airport-related questions here.... cuz this comment thread has long gone off-topic :D
May
3
comment Biometric authentication in the real world
@Rory, there are plenty of airports that allow passengers based on biometrics. Finding terrorists is a different story altogether... Though I agree it's flawed, I think it is actually a good idea there, even if accidentally - you shouldnt be trying to identify the passengers, you should be preventing guns/bombs/etc. Identifying the passengers is strictly in the interests of the airlines, to prevent ticket fraud, not terror attacks.
May
3
comment Books on Cryptography, with a focus on application to Network Security?
Most of the topics you mention are not network security. While TLS/SSL and such do have a network aspect, most of the others are e.g. cryptography, with no networking there... Are you sure thats what you need?
May
3
comment Biometric authentication in the real world
@Rory, actually the problem there is that you cant "identify" terrorists. It's not like you have a specific list of names of the terrorists.... well, except for the TSA's No-Fly list...
May
3
comment Is it correct to consider Task Based Access Control as a type of RBAC?
@Mikey, also note some of the quote - part of it is a logical way of partitioning roles. Do you do this by organizational "role" (title), or by technical tasks? This disconnect is what makes role management so tricky. There is usually not one correct answer...
May
3
comment Can ECC be used without infringing on patents?
Umm... @Thomas, I have no idea what most of the above means, but that doesn't mean that if I used ECC, I wouldnt use them without knowing it... But I guess one could specifically look out for these.
May
3
revised Are there any tools for automated penetration testing of Silverlight applications?
edited tags
May
3
comment IP Address spoofing?
That would apply to the first part of the quote: "does not care about the response". But the OP was asking how "the attacker has some way of guessing"...
May
3
revised IP Address spoofing?
edited tags
May
3
answered Can ECC be used without infringing on patents?
May
3
revised Can ECC be used without infringing on patents?
edited tags
May
3
comment List of good security blogs one should read
Coverted to wiki as "List of ..." question...
May
3
comment Why re-verify with CAPTCHA on failed form entry?
@Tim, it is only a very slight barrier. Like trying to stop an automobile using marshmallows. It goes back to the point, using CAPTCHA is misplaced in the first place.