Reputation
58,975
Next tag badge:
593/400 score
74/80 answers
Badges
17 146 240
Newest
 Nice Answer
Impact
~2.3m people reached

6m
comment Definition of security incident
As an example: the IR steps for someone accidentally leaking their AD password over Skype are completely different to the IR steps for a malware outbreak or a physical breach, and they are also different to a breach of PCI infrastructure or a leak of customer data. Certain things need to be reported to regulatory bodies, certain breaches require customers to be notified, certain events require C-level staff to be appraised. A major goal of an IR policy is to define the meaning of "security incident" in the context of the company's different infrastructure segments.
11m
comment Definition of security incident
Schroeder is correct. To be clear, a good IR policy doesn't just state what has to be done, but also defines the circumstances in which actions should be applied, who needs to be notified, the timeframes of each step, and also explains why each of these are important. This gives a context for the person applying the IR policy, so that improvisations can be made should something unusual arise.
2h
comment Definition of security incident
Absolutely anything event that may have negatively impacted the security of an organisation can be considered a "security incident".
2h
comment What security problems are exposed by running untrusted macros in excel?
@NeilSmithline Agreed. It should be made clear that obscurity measures work best against threat actors that are likely to be performing generic attacks against a wide number of people. If your expected threat actor is likely to be tailoring things for you or your organisation specifically, they won't be anywhere near as effective.
10h
comment What are the privacy and security implications of Windows Telemetry
Also, the answer to this depends on your settings. The "Basic" option sends back your hardware spec, list of installed programs, and some of your configuration settings in Windows. I don't know the details of what gets sent with other options.
10h
comment What are the privacy and security implications of Windows Telemetry
Switching OS seems a bit drastic. Just disable telemetry entirely.
Aug
24
comment BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”
My bad - I somehow misread that entirely. I'll edit that in.
Aug
21
comment What is the argument for the fairly prevalent “No more than n repeating characters” password rule?
I think the line of thinking is that "Aaaaaaaa9" is a bad password, and preventing repeated characters should stop them from being used. I agree that it's a bad way to go about it though.
Aug
20
comment Is Linux spying on its users?
Of course they could. They created the distro.
Aug
20
comment Why do we still use keys to start cars? why not passwords?
@Ulkoma Sure, but it's inconvenient to fiddle with a combination lock if you're trying to open your car. A key is just insert and twist. It can be done in the dark. It can be done with one hand. It can be done if your fine motor control isn't good.
Aug
20
comment Why do we still use keys to start cars? why not passwords?
Then you've got much bigger problems than getting into your car's unlock app. Arguably you shouldn't be driving at all if you're suffering from retrograde amnesia.
Aug
20
comment Why do we still use keys to start cars? why not passwords?
Usually poor protocol (vulnerable to sniffing or replay), poor RNG, poor crypto, poor implementation on the car side (e.g. not enforcing correct state machine) or anything in between.
Aug
20
comment Why do we still use keys to start cars? why not passwords?
Because every time a solution like this comes out, it's horribly broken, people's cars get stolen, and manufacturers have to do huge recalls.
Aug
6
comment Does ssh-agent store the SSH key passwords in cleartext in the memory?
@kasperd Not necessarily. Evil maid attacks, etc. are common threat scnearios.
Aug
6
comment Does ssh-agent store the SSH key passwords in cleartext in the memory?
@kasperd Right. But if they have physical access, they can just install a hardware keylogger, or a PCI card with memory access, or any other kind of hardware backdoor.
Jul
15
comment
@Ulkoma Absolutely not. It is an integral part of my love of Metal Gear Solid!
Jul
15
comment
@DeerHunter Kilts are acceptable, of course.
Jul
15
comment
@MikeOunsworth To me, professionalism just means wearing pants.
Jul
15
comment ASP.NET Machinekey encryption
@Levi Ah, well I shall defer to your knowledge on the matter. Weird though - I'm sure I got that description of behaviour from RE'ing the assemblies.
Jul
13
comment Can't get rid of “Your connection to website is encrypted with obsolete cryptography”
@StackzOfZtuff Sorry, I conflated the two.