10,003 reputation
11547
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 4 months
seen 10 hours ago

Canadian insurance company Security Manager.


Mar
5
comment What is wrong with a confirmation page displaying my password?
@Iszi Agreed. The problems of transmitting a password, in any form, in plain text has the obvious shoulder-surfing/interception issues that may or may not be an issue in the moment, but it indicates the potential for other problems with the development security model.
Mar
5
reviewed Approve suggested edit on Are two anti-virus better than one in protecting your computer?
Mar
5
comment Automatic exploit searches
exploit-db's archive in csv form would also have what you need.
Mar
5
comment how are CVSS scores used in security risk management products?
@sashank CVSS scores are used "as input" to the organizational calculations. They are raw data scores without relevance. You don't extrapolate, you interpolate. By combining those scores with a relevance metric, such as the environmental score, you get an organizational score. crato gave you the answer you asked for.
Mar
4
reviewed Approve suggested edit on Are two anti-virus better than one in protecting your computer?
Mar
1
revised How can I Hide my Public IP Address
spelling
Feb
26
comment NaCl: US Export Regulations
Comment or answer makes no difference. Bad advice all around. Encryption export controls are maintained by international agreements and are not US-specific.
Feb
25
answered Compliance with an industry recognized framework - ISO27k
Feb
25
comment “Keyset does not exist” when using SignData function with RSA
And I assume you used the ToXMLString function for those bare strings?
Feb
25
comment The overlapping fragment attack using Scapy
If you are hoping to craft a packet to pass through a firewall on port 80, but connect to a telnet server on the outside, why not just setup the telnet server on port 80?
Feb
25
comment The overlapping fragment attack using Scapy
Not sure that I can envision what you hope to do here. You want to overwrite data after it has passed through the firewall? If you change dest port numbers part way through a fragment, are you hoping to connect to the 'new' port number?
Feb
25
comment NaCl: US Export Regulations
No part of this answer is actionable.
Feb
25
comment Compliance with an industry recognized framework - ISO27k
Part of the answer deals with 'why'. Do you have a regulatory requirement for such an alignment? Did a manager hear about a framework and wants to see it implemented? Do you need to prove to partners or customers that you adhere to a framework? Does your organization want the benefits of employing a framework?
Feb
19
revised How can it be possible to have encrypted communication between a server and a client if the server has only a public key
spelling, grammar
Feb
19
comment How can it be possible to have encrypted communication between a server and a client if the server has only a public key
look at SSL/TLS .... Is this a homework question?
Feb
13
comment manually approach to check vulnerabilities?
"We are not supposed to use..." Is this a homework assignment?
Feb
6
revised what freeware tool for java source code review?
tag
Feb
6
reviewed Leave Open Is it safe (or a good idea) to advertise the use of bcrypt?
Feb
2
answered Is Telegram secure?
Feb
2
revised Is Telegram secure?
spelling, links