9,973 reputation
11547
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 4 months
seen 8 hours ago

Canadian insurance company Security Manager.


Mar
11
revised Isolate dual system
punctuation
Mar
11
comment Internal / external Penetration testing a webserver - PCI
Need more info - are you storing CC info on a database at the hosting site? Is the hosting company specialized to deal with PCI compliance? Is it a shared or dedicated server?
Mar
11
answered Internal / external Penetration testing a webserver - PCI
Mar
11
comment Is there any way to restrict multiple access to my server at the same time using one client certificate?
This seems the most logical. If the login can only be successful if the cert matches the login, then you simply handle the authenticated sessions at the application level. Putting the control any further down the stack could result in @Gilles' issues in his comment above.
Mar
11
revised Is there any way to restrict multiple access to my server at the same time using one client certificate?
Clarity - removed redundant lines - added the relevant service
Mar
11
comment What if anything is the security differences between team viewer 7 and team viewer 9?
Increased passcode complexity addresses one of the issues. The plaintext communication between server-client is the other and I see no mention. It would need to be verified.
Mar
11
comment What causes a powershell payload to run the first time but not the second?
The code in that article is pretty rough. Perhaps it doesn't exit out of PS cleanly and hangs the process?
Mar
11
revised IPSec sequence number
grammar
Mar
10
answered Retention periods for web logs
Mar
10
comment Exploiting through a filtered port
I assume 192.168.2.2 is the TARGET_IP?
Mar
10
answered How is a “commonly used password” determined?
Mar
10
comment Protecting against/detecting a specific Man in the Middle attack
Is the server the trusted authority for validating the keys? Clients could digitally sign their public key, if the CA is not the server you are suspecting. As long as the cert chain is properly configured, the server could not interfere without being noticed.
Mar
5
comment Can this code be expoited using Buffer Overflow?
@TimWilliams Perhaps you need to bold the lines that might make the successful exploit clear.
Mar
5
comment What is wrong with a confirmation page displaying my password?
@Iszi Agreed. The problems of transmitting a password, in any form, in plain text has the obvious shoulder-surfing/interception issues that may or may not be an issue in the moment, but it indicates the potential for other problems with the development security model.
Mar
5
reviewed Approve suggested edit on Are two anti-virus better than one in protecting your computer?
Mar
5
comment Automatic exploit searches
exploit-db's archive in csv form would also have what you need.
Mar
5
comment how are CVSS scores used in security risk management products?
@sashank CVSS scores are used "as input" to the organizational calculations. They are raw data scores without relevance. You don't extrapolate, you interpolate. By combining those scores with a relevance metric, such as the environmental score, you get an organizational score. crato gave you the answer you asked for.
Mar
4
reviewed Approve suggested edit on Are two anti-virus better than one in protecting your computer?
Mar
1
revised How can I Hide my Public IP Address
spelling
Feb
26
comment NaCl: US Export Regulations
Comment or answer makes no difference. Bad advice all around. Encryption export controls are maintained by international agreements and are not US-specific.