1,304 reputation
721
bio website cfcausa.org
location Kansas City
age 30
visits member for 2 years, 7 months
seen 21 mins ago

Systems Security Engineer for Unbound, a non profit organization.

Want to help someone living in poverty? Check us out at www.unbound.org.

Want to get linkedin?


Sep
5
comment Do we need to use separate IP ?
I hate to disagree but there are a lot of 'firewalls' that actually have level 7 inspection capability, especially for HTTPS. If that's the case and and the decrypted cardholder data is in memory the firewall is in scope. That is an easy point for folks to get confused on and it took a couple reads to get that from your post.
Aug
23
comment Encryption key exchange for Tor
@Adnan not the circuit building so much - the post I linked to does a good job with that - but some additional details on how the key exchange process works would be much appreciated.
Aug
20
comment Encryption key exchange for Tor
@DeerHunter thanks. I typed that up on my mobile.
Aug
6
comment Pre / post disk encryption wipe?
Thanks. This is helpful. I still don't see the difference about the wiping tool even if confidential data is already present. Once the data is encrypted and rewritten by the in place tool it's no longer free space. The OS knows this. Overwriting all the free space should still result in the entire drive being encrypted. Right?
Aug
5
comment Pre / post disk encryption wipe?
@enigma I came across that dame post before I asked. No answer. :)
Jul
8
comment How to detect eavesdropping by your ISP
That is just plain wrong.
Jun
14
comment Dual control / key encrypting key required?
@apsillers - that is a genius way of looking at it.
May
12
comment User Account Control and outside processes
@WChargin - correct
May
6
comment What does having an internal two-tier PKI protect against?
@MDMarra - even an online responder needs a source for the OCSP data. Once compromised you can't expect the online ca to provide it. Unless I'm mistaken that also needs to come from the offline CA being higher up the hierarchy.
Mar
22
comment How would you detect whether customer data has been leaked?
@D.W. - I saw a three year term for one of the vendors I looked at. Thought about actually marketing doing this as a support feature with a 1, 2, or 3 year term.
Mar
6
comment Normalizing Windows Advanced Firewall rules
The rules are based on security groups in Active Directory, not subnets. There isn't a way for a given IP (windows and joined to our domain or otherwise) to get access without successful authentication (by being a member of the approved group in AD).
Mar
5
comment Normalizing Windows Advanced Firewall rules
Once segmented only Windows systems would be part of the cardholder environment. By using Windows Advanced Firewall + IPSEC it isn't possible for non authenticated systems (my Linux and OSX boxes included) to access the cardholder environment.
Feb
22
comment Preventing artificial latency or “Lag Hacking” in multiplayer games
Wow.. The topology you're describing is a whole lot like how Netflix handles its streaming video deployment. Would never have thought about using it as an anti cheating mechanism. Basically the same premise just with CPU power instead of disk space. I've been wondering about the same issues Root outlined for years. Very well stated.
Dec
7
comment IIS 6.0 - mitigating BEAST
@Thomas - I'd love to see an example of turning off these ciphers. We're getting failed on our audit for the same reason. It's an old Exchange 2003 box and we're getting failed for our SSL encrypted SMTP rules.
Nov
14
comment Attack vectors opened simultaneous wireless and wired networks
Thanks D.W. - that is what I was thinking but I wasn't familiar enough to be sure.
Nov
14
comment Attack vectors opened simultaneous wireless and wired networks
Helpful, thanks. What I'm looking for is some help with the analysis of what kind of threats are created specifically from having both connections active at the same time. I'll revise my question body to reflect this. Any assumptions it looks like I've made are accurate to my situation.
Nov
14
comment Attack vectors opened simultaneous wireless and wired networks
Thanks. The networks in question would make be totally independent other than the laptops
Nov
14
comment Attack vectors opened simultaneous wireless and wired networks
@asudhak - there are zero days which can run arbitrary code, including reverse connections to open consoles. From there the routing commands would be easy.
Oct
23
comment What are the security or privacy issues with allowing users to forward email from our Google Apps account to their personal Gmail?
Wasn't the answer you received on serverfault an hour ago good enough? serverfault.com/questions/441449/…
Sep
1
comment IPSec Domain Isolation with Windows Server
@Nock- request mode is ipec being optional, allowing unencrypted connections. The second paragraph is attempting to describe the different modes.