schroeder

7,536 reputation

11037

bio	website
	location	Canada
	age
visits	member for	1 year, 5 months
	seen	May 16 at 23:06
stats	profile views	340

Canadian insurance company Security Manager.

	7,536 reputation	bio	website		visits	member for	1 year, 5 months
11037 badges		location	Canada		seen	May 16 at 23:06

summary answers questions tags badges favorites bounties reputation activity

386 Comments

suggestions reviews revisions comments badges posts accepts all

Jan 18	comment	How do hackers take advantage of open ports as a vector for an attack? Time-efficient is an important consideration, but defense in-depth means that you need to limit the services running on a machine.
Jan 18	comment	Regulations that specify password length? Right. SOX, AR 25-3, and ISO 27001 all state that there needs to be a minimum and maximum enforced, but just the PCI-DSS that actually says what the minimum should be.
Jan 17	comment	Who (which process) is calling curl? Sorry, I'm so used to having to interpret poor grammar on this site that I actually interpreted your proper grammar incorrectly. I thought you were looking for a user who is calling a process ... Feel free to disregard.
Jan 16	comment	CIS vs CS for Information Systems Security? Ask the CIA? Look at their current postings to get a sense of what they are looking for.
Jan 12	comment	How can I protect a client's mirror of the server's database? But I don't think that's true. The source of the updates is the remote database, but it's the local client that performs the update. Or, am I missing something?
Jan 11	comment	How to demo a new 0-day security product? This comment is SO off topic, but if you are developing product (and even if you're not) Seth Godin is the "God of Marketing" - marketing of all types. I read him every day: sethgodin.typepad.com
Jan 11	comment	How to demo a new 0-day security product? You want to tell a story about how you catch 0-days. And how you tell that story is the marketing question. It is ok if you use known attacks, if that fits into your story. There are technical limitations that prevent you from telling a different kind of story.
Jan 11	comment	How bad is a source code leak for an antivirus? You are correct, but code review is far easier and more efficient than fuzzing.
Jan 11	comment	Is this non-cookie based session scheme horribly vulnerable to some attack? What about a token replay? Can I take a token from another session and take over that session?
Jan 11	comment	How can I protect a client's mirror of the server's database? I hear you saying that you are downloading an authentication database to a local client and you want to prevent unauthorized users from viewing the data. Do I have that correct?
Jan 10	comment	In the case of the Gawker data breach, would strong passwords be ok? Why worry? Change your password.
Jan 9	comment	Business systems development (.NET, Java) vs IT Security Field, salary/future perspective And then there's this: "IT Security Pros Go Full Year with No Joblessness" govinfosecurity.com/articles.php?art_id=4385 :)
Jan 5	comment	Is there any FOSS passive vulnerability scanner ? Not a NIDS but a vulnerability assessment tool PVS will perform a vulnerability scan on any new machine it detects, which is not a Snort function. Snort reads traffic, it does not perform active scans.
Jan 5	comment	Is there any FOSS passive vulnerability scanner ? Not a NIDS but a vulnerability assessment tool Snort is still the king in IDS-land, but I'm not sure Snort does what PVS does. OpenVAS with a Snort scan for new hosts seems to be the closest to what the OP suggests.
Jan 3	comment	Sniffing on VPN configuration I am interested in your use of VPN here. What do you mean by "Everyone in the office uses a VPN"? Otherwise VPN is not a barrier to sniffing anything on your network.
Dec 21	comment	Network Vulnerability Scanner placement on network Isn't this a question for Qualys?
Dec 19	comment	How to scan Javascript for malicious code? I totally agree that the JSA is not designed to be a total solution to review random code from the public, but it IS a static scanner that deals with security implications. And, as far as I know, the only one on the market. That being said, it becomes an option for the OP who wanted something "like an antivirus", even though he should consider another strategy entirely. --- Is my answer still worth a down-vote?
Dec 15	comment	Monitor data a program sends to internet If the data it is sending is encoded or encrypted, then there might not be any way to see the data being sent. But it there was, Wireshark IS the way to capture the data that you can try to decode/decrypt.
Dec 14	comment	How anonymous is my setup? @RyanM. is right. Breaking someone's wifi security to piggy-back on their signal would be illegal in a lot of jurisdictions. It might be successful in making you 'anonymous' but there are other options.
Dec 14	comment	What utilities exist to brute force a username and password? I'm not sure that the OP was concerned about anonymity, and Acunetix won't help with Terminal Server.