2,240 reputation
1015
bio website
location
age
visits member for 3 years, 8 months
seen Nov 4 '11 at 15:09

Jan
12
answered How to define security requirements to ensure that developers… do not provide security by obscurity?
Jan
12
comment What is the proper priority/mix of (people, tools and technology, processes) to optimize defense?
The bare minimum of questions to answer before asking this one is (1) To protect what? (2) Against what threats? (3) With what level of residual risk as acceptable?
Jan
10
answered What's are the advantages of L2TP/IPSEC over plain IPSEC?
Jan
10
comment The aescrypt implementation hashes a password 8192 times to generate the key. Is this necessary?
Graham, in the average case, the security of a scheme is a monotonically increasing function of the number of smart people who've tried to break it. Since "aescrypt" returns 5,000 hits on google, and "gpg" returns 3,000,000, the conservative conclusion is that gpg is more secure.
Jan
4
comment Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc?
Perhaps amending "dealing with APT" to "dealing with the possibility of APT" would qualify more answers--it's my understanding that most security professionals who are actually dealing with APT have some very strong NDEs about it.
Dec
22
comment Security review: “HTTP header user-agent has been set to (something)”
I agree with Ams; it depends on the context in which the user-agent string is used by the application. If, for an egregious example, the user-agent were used without further sanitization in a database query, allowing \" could enable blind SQL injection.
Dec
21
comment Security papers or material focusing on the industrial control systems (SCADA)
Fantastic resource. There have also been a lot of talks at 2010 security/hacker conferences on SCADA-related subjects. Here are a few;
Dec
20
awarded  Commentator
Dec
20
comment Fortify360 - Sinks & Sources - Vulnerability count
From my perspective, the way you report to the customer shouldn't depend primarily on the software you're using. Whatever you feel would be the most accurate way to report the results if you'd discovered them by manually checking all the code, that's the way I'd say to do it.
Dec
20
answered What are the weaknesses of this password-generation-method? How can it be improved?
Dec
17
comment Firewall Reviews - What is in your Toolbox?
Matasano's Playbook is the only firewall ruleset management tool I've read about, but Matasano's Thomas Ptacek really knows his stuff.
Dec
16
answered What techniques and tools do you use to relate security events?
Dec
14
answered Practical DRM for pdfs
Dec
13
comment Are NTFS Alternate File Streams considered a security risk in your organisation; how is it mitigated?
There are some ameliorating factors, data-leak wise, for Alternate Data Streams--for instance, if you write the files to a CD or DVD, the ADS is gone; and if you care at all about DLP you're already blocking flash media. ADS will not transfer with a file by http or ftp. I see ADS as more of a primitive malware hiding issue than a DLP issue.
Dec
10
comment Citations for inadvisability of globally unique password
There's a few approaches to deletable bloom filters; and the customer did not require passwords which were not duplicates to be 100% accepted. But it's certainly an ugly kludge, your larger point stands.
Dec
9
comment Detecting website attack attempts
You mentioned OWASP, but not their Web Application Firewall. Is there anything you'd like to do that isn't handled by the WAFs listed on that page?
Dec
9
answered How much can I trust Tor?
Dec
9
comment How do I identify an unknown port/protocol that my IDS picks up?
Tate, that's actually an answer I'd considered. What gives me pause is that I've seen several projects start down that road, but haven't seen any make it to the "useful results" phase--which in the anthropic sense means it's more difficult than it looks.
Dec
9
comment How do I identify an unknown port/protocol that my IDS picks up?
Msrpc and Sun rpc do use high ranges, but I see a lot of consistent ports outside these ranges with a lot of traffic.
Dec
8
awarded  Student