17,661 reputation
23275
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 3 years, 3 months
seen 4 hours ago

Security Architect


Feb
6
comment Certificate Issuer is Network Company
unless the certs are installed by group policy and employees are informed via corporate policy- then the users are not faced with errors and there is notification
Feb
6
comment Cyber Security Training v. Cyber Security Education for Middle to High Schoolers
The particular issue with "hacking" is that the Tactics Training is so readily available without context or guidance.
Feb
6
answered Cyber Security Training v. Cyber Security Education for Middle to High Schoolers
Feb
6
comment Cyber Security Training v. Cyber Security Education for Middle to High Schoolers
Aren't training and education the same thing? Or do you mean focusing on standard curriculum?
Feb
6
comment Implement GPG Verification (Bitcoin-OTC)
No problem. You have an interesting scenario.
Feb
6
answered Certificate Issuer is Network Company
Feb
6
comment Implement GPG Verification (Bitcoin-OTC)
#5 is not a security question but a question for the Bitcoin-OTC's devs.
Feb
6
reviewed Close network IDS capabilities for attack detection
Feb
6
reviewed Looks OK Why encrypt data in memory?
Feb
6
comment What are the differences between an encryption seed and salt?
A salt is not stored 'instead' of a password, it is stored along with the hashed salted password, as you say. You've kinda contradicted yourself. Also, the salt is not always random, but can be derived from some user data.
Feb
6
awarded  Peer Pressure
Feb
6
awarded  Good Answer
Feb
6
reviewed No Action Needed What is the point of AES key wrap (with JSON Web Encryption)?
Feb
6
comment Hack to change the webpage of a website?
SQLi, RFI, XSS, server config errors, brute forcing the ssh/ftp logins. There are too many methods to mention.
Feb
6
revised What are the differences between an encryption seed and salt?
minor edits so I could revote
Feb
6
comment What are the differences between an encryption seed and salt?
my misunderstanding stemmed from the requirement for reseeding, which I understood to mean that even if a seed was known, it would have little value to the encryption created from that value, which is not correct but that reseeding protects the CSPRNG as a whole.
Feb
6
comment What are the differences between an encryption seed and salt?
you are absolutely correct, I have had a misunderstanding all along. I just read the NIST guidance and they support your statements: csrc.nist.gov/publications/drafts/800-90/… Section 8.6.6
Feb
6
comment Setting up own enterprise SOC
Incident response, in my opinion as a SOC architect, is where the cost resides. If all you are looking for is 24x7 log analysts who send alerts when anomalies are found, then yes, you can do that for lower cost, but once you need experts handling Incidents 24x7, then your costs skyrocket. Add in the 3rd party's certification (SOC, ISO, FEDRAMP, etc.) and "millions" is not out of the question.
Feb
6
comment Hack to change the webpage of a website?
That isn't what I'm saying. I'm saying that for THIS attack, the attackers had complete access to the backend. As for how one could deface a random web page, there are many, many ways to do that.
Feb
6
reviewed Close Hack to change the webpage of a website?