17,640 reputation
23275
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 3 years, 3 months
seen 2 hours ago

Security Architect


Feb
7
comment Test sslv3 poodle locally in windows
You could run the same command from Linux to your Windows machine.
Feb
7
comment Hashing a password, and summing it with every byte in a file. How secure?
How is the password decrypted after the hashing?
Feb
6
comment Certificate Issuer is Network Company
unless the certs are installed by group policy and employees are informed via corporate policy- then the users are not faced with errors and there is notification
Feb
6
comment Cyber Security Training v. Cyber Security Education for Middle to High Schoolers
The particular issue with "hacking" is that the Tactics Training is so readily available without context or guidance.
Feb
6
comment Cyber Security Training v. Cyber Security Education for Middle to High Schoolers
Aren't training and education the same thing? Or do you mean focusing on standard curriculum?
Feb
6
comment Implement GPG Verification (Bitcoin-OTC)
No problem. You have an interesting scenario.
Feb
6
comment Implement GPG Verification (Bitcoin-OTC)
#5 is not a security question but a question for the Bitcoin-OTC's devs.
Feb
6
comment What are the differences between an encryption seed and salt?
A salt is not stored 'instead' of a password, it is stored along with the hashed salted password, as you say. You've kinda contradicted yourself. Also, the salt is not always random, but can be derived from some user data.
Feb
6
comment Hack to change the webpage of a website?
SQLi, RFI, XSS, server config errors, brute forcing the ssh/ftp logins. There are too many methods to mention.
Feb
6
comment What are the differences between an encryption seed and salt?
my misunderstanding stemmed from the requirement for reseeding, which I understood to mean that even if a seed was known, it would have little value to the encryption created from that value, which is not correct but that reseeding protects the CSPRNG as a whole.
Feb
6
comment What are the differences between an encryption seed and salt?
you are absolutely correct, I have had a misunderstanding all along. I just read the NIST guidance and they support your statements: csrc.nist.gov/publications/drafts/800-90/… Section 8.6.6
Feb
6
comment Setting up own enterprise SOC
Incident response, in my opinion as a SOC architect, is where the cost resides. If all you are looking for is 24x7 log analysts who send alerts when anomalies are found, then yes, you can do that for lower cost, but once you need experts handling Incidents 24x7, then your costs skyrocket. Add in the 3rd party's certification (SOC, ISO, FEDRAMP, etc.) and "millions" is not out of the question.
Feb
6
comment Hack to change the webpage of a website?
That isn't what I'm saying. I'm saying that for THIS attack, the attackers had complete access to the backend. As for how one could deface a random web page, there are many, many ways to do that.
Feb
6
comment What are the differences between an encryption seed and salt?
seed does not need to be secret: en.wikipedia.org/wiki/…
Feb
5
comment Generating token for email validation and registration security
Welcome to Security.SE. Question quality is important and it is valid to edit out narrative aspects to questions so that those posting do not devolve into long stories that do not augment the question being asked.
Feb
5
comment Setting up own enterprise SOC
Your list of activities for a SOC isn't really a SOC: you've only described log analysis. Have you read something like this: defcon.org/images/defcon-18/dc-18-presentations/Pyorre/…
Feb
5
comment Improve the security of a website implementing the least privilege principle
don't cross post on SE sites: security.stackexchange.com/questions/80876/…
Feb
5
comment Is it dangerous to serve user-uploaded Flash (SWF) files?
The OP has a site-builder, so the requirement is coming from the user's themselves. This doesn't really answer the question.
Feb
5
comment What are the differences between an encryption seed and salt?
@Ajedi32 if the OP's explanation confused the audience, then I wasn't going to try to explain pseudo-randomness.
Feb
5
comment Is it dangerous to serve user-uploaded Flash (SWF) files?
Older versions contain vulnerabilities, not exploits, per se.