18,671 reputation
23375
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 3 years, 5 months
seen 5 hours ago

Security Architect


Mar
12
comment Does Dropbox offer any protection against infected files?
This is a question for Dropbox support.
Mar
12
comment Is it legal to start a private website for you and your friends to hack?
@EricG I completely agree about legal questions, but I don't think there is really a legal question here. I think that there is a more basic question being asked in the context of "legality".
Mar
12
comment Is it legal to start a private website for you and your friends to hack?
Have you considered the many hack-able VMs?
Mar
11
comment How to know if I'm using openSSL properly
so, things like: how your implementation handles expired/revoked certs, invalid certs? As for cipher suites, most vuln scanners will do that.
Mar
11
comment proxy servers and restricted work computers
@k1DBLITZ Assuming the OP's employer uses a VPN... VPN inside a VPN is tricky, but you can chain VPNs at a middle point.
Mar
11
comment Detecting web app attacks by parsing log files
The accepted answer for the other question highlights a tool that will parse the logs for many different types of attacks, including SQLi.
Mar
11
comment Detecting web app attacks by parsing log files
Product recommendations tend to get closed. Is there a way to re-phrase this question so that you can get the help you need without a product recommendation?
Mar
11
comment Segregating a Printer in my Enterprise Network
Get a printer with better login security? Keep it turned off until you need to print?
Mar
11
comment Backup procedure for PCI
1) Are you sure that you need to be PCI compliant? 2) Always store backups on encrypted media and store offsite. 3) Regularly test that you can recover data from the backup media.
Mar
10
comment NMAP Scan Returns Odd OS Detection
when posting questions about nmap, please include the full nmap command you used. I suspect that you need to increase the verbosity: -vv
Mar
10
comment Printer IP scanning via Nmap
Then there is no difference from the OP's result from the posted scan. I'm not sure how your code adds anything.
Mar
10
comment NMAP Scan Returns Odd OS Detection
we need way more data from the scan to help - like the OS fingerprint
Mar
10
comment Printer IP scanning via Nmap
According to your code, you will find (grep) all nodes that use SNMP. There doesn't appear to be any way to filter based on printers.
Mar
10
comment Printer IP scanning via Nmap
won't this find all nodes that use SNMP?
Mar
10
comment Open-source penetration-test automation
I tried Dradis, which is why I wanted to do better in Redis. Never tried LAIR.
Mar
10
comment Open-source penetration-test automation
I've spent a lot of time trying to do this on my own. Writing scripts, leveraging Redis for persistence. This is gold.
Mar
10
comment Is End to End encryption possible for all servers across the whole infrastructure?
Step 1: define the data classification of the data being sent. Step 2: define appropriate protections for each data classification. Step 3: now find out where you need to encrypt. It's doubtful that everything needs to be encrypted.
Mar
10
comment Is End to End encryption possible for all servers across the whole infrastructure?
It might be helpful to know why each and every stream of traffic needs to be encrypted at the server level. Is it web traffic? What kinds of applications are involved (custom, COTS)? Can the data be encrypted and sent over non-encrypted channels? You talk about what you can't find, but you don't define the requirements.
Mar
9
comment Questions to confirm a good standpoint on web app security?
You and the testers work that out together. Each organization requires different deliverables. A qualified tester will guide you through that.
Mar
9
comment How do people keep track of their employee's privileged accounts?
In the end, you need some sort of database, but spreadsheets have a drawback: they are hard to audit. What happens if someone with access to the spreadsheet hides a user's account?