20,792 reputation
33981
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 3 years, 6 months
seen 7 hours ago

Security Architect


Jun
25
comment What should I tell my client if I see that their site is susceptible to SQL injection?
Look at it this way: it's your code now that you've been asked to maintain it....
Jun
25
comment Sniffing wireless LAN network using tcpdump
what does dst mean to tcpdump?
Jun
25
comment Evaluating encryption/promised anonymity of message service
The question of code review is WAY too broad.
Jun
25
comment Lost in a field of Degrees and certifications
Do you want a BS specifically? I mostly see BA and BTech as options. I'm not sure that a BS exists for InfoSec (because it's not science)
Jun
25
comment Lost in a field of Degrees and certifications
What is Part 1 of your question? I think it needs re-wording.
Jun
25
comment Ghost CMS abnormal access
It's also possible that the crawling of the root was done by another IP that passed the new link list on to subsidiaries. The IP you post is listed in the 'botnet' directories, so it's possible.
Jun
25
comment Ghost CMS abnormal access
Perhaps, is that what happened?
Jun
25
comment Nil events in IPS reports today
@void_in my thoughts exactly, if 1-2 is normal, then I might suspect a misconfigured IPS.
Jun
25
comment Encryption Laws in India
This is the type of legal question that IS allowed here: not asking "is this legal?", but rather, "what are the laws?" The answers will not constitute legal advice, but simple research. That said, the research is pretty easy ...
Jun
25
comment Bypass User Account for permissions/priviligies
We are not tech support and we will not help you bypass your company's security.
Jun
25
comment My Virgin Media account password is visible in plaintext to call center staff. What do I do?
You must assess your risks for each asset (I don't cycle all my passwords), but you seem to suggest that with MFA and good practices on the vendor side that you won't change your passwords at all, even after a known disclosure event. Cycling your passwords still needs to be a part of password management.
Jun
24
comment My Virgin Media account password is visible in plaintext to call center staff. What do I do?
You forgot the requirement to refresh your passwords on a schedule. Just setting-and-forgetting passwords will compromise your password management plan.
Jun
24
comment My Virgin Media account password is visible in plaintext to call center staff. What do I do?
You forgot the requirement to refresh your passwords on a schedule. Just setting-and-forgetting passwords will compromise your password management plan.
Jun
24
comment Reasons for gathering MAC address list
Ah ok - so in ADDITION to the expressed reason of whitelisting MACs, what reasons might there be? You don't state that there is a primary reason for maintaining a list of MACs.
Jun
24
comment 3rd party phish feeds
From your most recent response, I have to ask why you need the email content. Most phishing emails include an URL or attachment for the user to act on: most anti-phishing technology parse those things instead of the email content itself because the content is too varied to analyze. I think there will be an easier way to protect against phishing than parsing content.
Jun
24
comment Finance with the multitude of “Secure Browsers”
I'm not sure Incognito mode belongs on your list - it is not a security mode of operation. As for the specific question of fresh VM and keylogging, those details will be available from the vendor. As for "which is most secure", you don't define what you want to secure against and it is very open-ended and opinion-based.
Jun
24
comment Hardening BMC Remedy OnDemand ITSM 8.1
This would be a question for BMC.
Jun
24
comment Is it possible for someone else to add a photo to text messages I am sending?
What application were you using? What kind of phone? Had you viewed the image recently? Are you sure that the photo came from you and not the receiving party?
Jun
24
comment 3rd party phish feeds
There are many phish feeds. Phishtank is a big one. Please indicate what research you have done on your own so that we can better help you.
Jun
24
comment What are the major design elements for a internal security award? Are there identified industry standards?
There are no InfoSec industry standards for internal employee recognition. You will want to look at HR guidance for this kind of thing.