436 reputation
311
bio website
location Austin, TX
age 34
visits member for 3 years, 2 months
seen Oct 27 at 15:13

I'm currently studying for a Master's in Information Assurance and plan to concentrate on software security.

I'm here to try (and sometimes fail) answering questions; to deepen my knowledge and meet people to code projects with.

Thanks for reading!


Oct
27
comment Solution to allow JavaScript input but prevent XSS
+1 for showing one of the most non-obfuscated but still obfuscated XSS attacks I've ever seen.
Oct
27
comment Solution to allow JavaScript input but prevent XSS
Actually you have an auditing issue that @jrwren really opens right up for you. At a bare minimum, you're going to want some kind of versioning on any source code that a user submits and that you store. If you don't, and say that code IS used to launch attacks--you will at least be able to say when that piece of code was added, and be able to roll back to a known "good" state.
Oct
22
accepted How negative are virtual machines (vms) to /dev/urandom?
Oct
17
comment How negative are virtual machines (vms) to /dev/urandom?
So in answering the concrete question, "How badly does moving to a virtual machine harm entropy?" Its essentially subjective due to the total # of possible bits we lose in the move?
Oct
17
comment How negative are virtual machines (vms) to /dev/urandom?
Updated for a more concrete form of the question.
Oct
17
revised How negative are virtual machines (vms) to /dev/urandom?
added 60 characters in body
Oct
17
comment How negative are virtual machines (vms) to /dev/urandom?
@ThoriumBR Well, the results I got here were taken from one of our virtual machines. We use vmware, if that helps.
Oct
17
asked How negative are virtual machines (vms) to /dev/urandom?
Oct
17
comment Is a rand from /dev/urandom secure for a login key?
@NickJohnson run the following command on any linux machine: cat /dev/urandom | rngtest -c 1000 several times. IF its a vm (as many server environments are now) you'll fail FIPS compliance about every other run.
Jul
27
comment Exchange 2013 blocks txt file attachments - are there security reasons?
What about the simple hiding of file extensions? malicious.txt.exe ? Does exchange account for this?
Jul
23
comment security metrics on softwares developed
And if you're worried that these papers are just too aged, David Bell wrote "Looking Back at the Bell-La Padula Model" in 2005, and linked the problems in the 1970s to problems today.
Jul
23
comment security metrics on softwares developed
IMHO most security mgmt books rehash ancient concepts that were enumerated by the US Military in the 1970s. I would start with the Ware report "Security Controls for Computer Systems" and the Anderson report, "Computer Security Technology Planning Study." Schell: "Computer Security: The Achilles heel of the Airforce" These papers detail the birth, implementation, and death of Multics.
Jul
22
comment security metrics on softwares developed
In other words, if you have no policies your metrics have no solid footing.
Jul
22
comment security metrics on softwares developed
(Bought the book.) At any rate, I didn't mean to communicate that metrics weren't important, only that metrics by themselves are insufficient, which a novice security professional might not understand: Some come from a pure tech background and might not be prepared for the fact that security policy guides our interpretation of any metrics we collect which in turn guides our remediation priorities.
Jul
21
accepted How do I Mitigate Directory Traversal when User-Supplied Input is a Mandatory Business Case?
Jul
18
comment Better techniques than url parameter encryption
Security was consulted on this as well, and they signed off on this direction, even though I didn't like it.
Jul
18
comment Better techniques than url parameter encryption
@Luc Its mostly academic at 2yrs out, but it was really time-constraint. The web portion of that app was new and was built without any concept of RBAC. It was designed as an ad-hoc extension, not a fully-fledged webapp like it needed to be. The architect who was directing me made this design decision in order to meet the deadline.
Jun
25
awarded  Yearling
Jun
17
comment security metrics on softwares developed
@Boos I added one more reference: CVSS
Jun
17
revised security metrics on softwares developed
Added one more reference