10,013 reputation
11547
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 4 months
seen Apr 19 at 19:20

Canadian insurance company Security Manager.


Mar
20
comment A clear definition for procedural security controls?
I'm not sure that you will find anything more than that. It's a category - a distinction. Security controls that take the form of procedures, policies, and processes. As opposed to physical and technical controls.
Mar
20
comment Wireless entry systems why not use pre-shared noise?
Then what you've described is a persistent 'session key' scenario. The key is renewed when reader and token sync and persists until the next sync. Once you go down that road, then you need to combat cloning, which means encryption of the session key, and that adds computational time and delay in response. That is why active encryption like that isn't widely used.
Mar
20
comment A clear definition for procedural security controls?
Have you tried a google search? Wiki has a nice overview ... Aside from that, I am not sure what you're asking for.
Mar
20
comment Is a web application firewall necessary if the application is secure?
+1 for rapid fixes. I've been in companies where it would take weeks to fix a flaw in the code but minutes to provide the same protection on the WAF. The WAF is NOT a replacement for the code fix, but it is an effective stop-gap.
Mar
20
answered Is rolling my own firewall on top of my normal firewall dangerous?
Mar
20
comment How would I know if my Apple Mac has a virus, and what can I do if I have?
I completely agree, but despite the instances of failure (even if many) it is still better to have protection and to act properly than to do only one.
Mar
20
comment Log in security - saving a session
Please use existing authentication libraries available for your language. Don't reinvent the wheel.
Mar
20
comment How would I know if my Apple Mac has a virus, and what can I do if I have?
"how good you behave yourself" is a dangerous comment. You can do everything correctly and still become compromised by a drive-by download, for instance. Mac's need protection, just like everything else.
Mar
20
comment Wireless entry systems why not use pre-shared noise?
But that's why we use complex algorithms ... It is far easier to create mathematically testable results with math...
Mar
19
comment Security against IP Spoofing without consulting network administrator
Google is supposed to secure itself against what? The attack or a spoofed address? You seem to be confusing the two ideas.
Mar
19
comment Simulation of security against IP
This question is very confusing. Please rephrase.
Mar
19
comment Wireless entry systems why not use pre-shared noise?
How is the 'noise' being generated? A pre-shared key needs to be complex enough to increase the effort to brute force.
Mar
19
comment What are the possible rules to identify password sharing- to prevent fraud
If the motivation to share exceeded the motivation not to share, then your scheme fails. How would you detect if sharing was happening in order to enforce policy? If it is a work account, then your last point won't work because the point is to share access and authority.
Mar
12
comment Internal / external Penetration testing a webserver - PCI
I didn't say that it has to be a professional penetration tester.
Mar
11
revised Isolate dual system
punctuation
Mar
11
comment Internal / external Penetration testing a webserver - PCI
Need more info - are you storing CC info on a database at the hosting site? Is the hosting company specialized to deal with PCI compliance? Is it a shared or dedicated server?
Mar
11
answered Internal / external Penetration testing a webserver - PCI
Mar
11
comment Is there any way to restrict multiple access to my server at the same time using one client certificate?
This seems the most logical. If the login can only be successful if the cert matches the login, then you simply handle the authenticated sessions at the application level. Putting the control any further down the stack could result in @Gilles' issues in his comment above.
Mar
11
revised Is there any way to restrict multiple access to my server at the same time using one client certificate?
Clarity - removed redundant lines - added the relevant service
Mar
11
comment What if anything is the security differences between team viewer 7 and team viewer 9?
Increased passcode complexity addresses one of the issues. The plaintext communication between server-client is the other and I see no mention. It would need to be verified.