434 reputation
311
bio website
location Austin, TX
age 34
visits member for 3 years
seen 8 hours ago

I'm currently studying for a Master's in Information Assurance and plan to concentrate on software security.

I'm here to try (and sometimes fail) answering questions; to deepen my knowledge and meet people to code projects with.

Thanks for reading!


Jul
27
comment Exchange 2013 blocks txt file attachments - are there security reasons?
What about the simple hiding of file extensions? malicious.txt.exe ? Does exchange account for this?
Jul
23
comment security metrics on softwares developed
And if you're worried that these papers are just too aged, David Bell wrote "Looking Back at the Bell-La Padula Model" in 2005, and linked the problems in the 1970s to problems today.
Jul
23
comment security metrics on softwares developed
IMHO most security mgmt books rehash ancient concepts that were enumerated by the US Military in the 1970s. I would start with the Ware report "Security Controls for Computer Systems" and the Anderson report, "Computer Security Technology Planning Study." Schell: "Computer Security: The Achilles heel of the Airforce" These papers detail the birth, implementation, and death of Multics.
Jul
22
comment security metrics on softwares developed
In other words, if you have no policies your metrics have no solid footing.
Jul
22
comment security metrics on softwares developed
(Bought the book.) At any rate, I didn't mean to communicate that metrics weren't important, only that metrics by themselves are insufficient, which a novice security professional might not understand: Some come from a pure tech background and might not be prepared for the fact that security policy guides our interpretation of any metrics we collect which in turn guides our remediation priorities.
Jul
21
accepted How do I Mitigate Directory Traversal when User-Supplied Input is a Mandatory Business Case?
Jul
18
comment Better techniques than url parameter encryption
Security was consulted on this as well, and they signed off on this direction, even though I didn't like it.
Jul
18
comment Better techniques than url parameter encryption
@Luc Its mostly academic at 2yrs out, but it was really time-constraint. The web portion of that app was new and was built without any concept of RBAC. It was designed as an ad-hoc extension, not a fully-fledged webapp like it needed to be. The architect who was directing me made this design decision in order to meet the deadline.
Jun
25
awarded  Yearling
Jun
17
comment security metrics on softwares developed
@Boos I added one more reference: CVSS
Jun
17
revised security metrics on softwares developed
Added one more reference
Jun
17
comment security metrics on softwares developed
The last paper referenced gives you a tool to do exactly that kind of analysis.
Jun
17
answered security metrics on softwares developed
Jun
16
comment How do I secure “Data at Rest” only allowing Service API to access it from a mobile application
And don't forget the salt!
Jun
15
answered Implement KHOBE attack in practice
Jun
15
awarded  Citizen Patrol
Jun
15
comment Implement KHOBE attack in practice
Too much going on here in terms of questions. Implementing that attack in practice should be its own question.
Jun
10
comment Can't understand SNORT rule pcre option syntax “?P=name”
Did a little bit of digging. seclists.org/focus-ids/2006/Jan/95 <--Says that snort uses the PCRE lib --> pcre.org
Jun
9
comment Can't understand SNORT rule pcre option syntax “?P=name”
@Anorov's link provides the history. Python gave us the syntax (?P<name>group) first, and then later C# gave us (?<name>group). Perl adopted both syntaxes in version 5.10. Generally, as far as "standards" go, if a product is "PCRE" compliant, it usually means it works in Perl 5.10. (Which isn't really a standard...)
Jun
9
answered Can't understand SNORT rule pcre option syntax “?P=name”