10,003 reputation
11547
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 4 months
seen 5 hours ago

Canadian insurance company Security Manager.


Feb
25
comment NaCl: US Export Regulations
No part of this answer is actionable.
Feb
25
comment Compliance with an industry recognized framework - ISO27k
Part of the answer deals with 'why'. Do you have a regulatory requirement for such an alignment? Did a manager hear about a framework and wants to see it implemented? Do you need to prove to partners or customers that you adhere to a framework? Does your organization want the benefits of employing a framework?
Feb
19
comment How can it be possible to have encrypted communication between a server and a client if the server has only a public key
look at SSL/TLS .... Is this a homework question?
Feb
13
comment manually approach to check vulnerabilities?
"We are not supposed to use..." Is this a homework assignment?
Jan
28
comment Suppressing broadcast traffic in honeyd logs?
Filter packets at firewall?
Jan
27
comment Regulations that specify password length?
@MarkC.Wallace I agree that 'regulations' is a broad scope, but I'm not looking for applicability, merely an example of a regulation that makes a positive statement on password lengths.
Jan
22
comment Bank accepts different password to the one that I set
Not only that, but you hope you have enough complexity in those first few characters. "password1q@W" is nice and complex. "password" will be tried first in brute force ... If they only use 8 chars, then they need to communicate that to users to enable them to compensate.
Jan
21
comment How to find malicious images in server?
Images or html tags to images? Look through your web data to find img tags with CSRF code.
Jan
21
comment Basic Security Knowledge
These are all very good questions to ask, but you haven't asked them in a way that will help us answer you.
Jan
14
comment Security against IP Spoofing
@user2320464 Sure, but if the attacker can successfully perform an IP spoof, then they can edit a cookie to match
Jan
14
comment Security against IP Spoofing
@user1369975 the endpoint cannot do anything about a spoofed IP. The TCP/IP stack just wasn't designed for that level of integrity checking.
Jan
14
comment Security against IP Spoofing
@Anonymous I'm not upset. I'm correcting you while giving you a chance to fill-in any knowledge gaps that I might have. Fast and loose security advice hurts us all.
Jan
14
comment Security against IP Spoofing
Cite your source for "IP address spoofing is quite common in many attacks..." Have you personally used loose source routing at any point? It is frequently blocked making it impossible to use as a reliable vector for attack.
Jan
13
comment Security against IP Spoofing
Also, why are you considering logging the source port of the attacker? Those will be randomly assigned anyway and of little value as a means to identify blockable targets.
Jan
13
comment Security against IP Spoofing
Why would an attacker reach your non-main ports first? Your system depends on someone reaching non-critical services before the critical ones. That's a highly specific scenario.
Jan
13
comment How to find the actual address of spoofed IPs?
On what basis are you 'convinced'?
Jan
6
comment How to check if computer is controlled remotely
en.wikipedia.org/wiki/Wake-on-LAN
Jan
6
comment How to check if computer is controlled remotely
Unless it is set to wake up to receive commands from a controller ...
Jan
4
comment How safe is backtrack to use?
@AviD agreed, but in this case, it isn't simply bugs, but behavior. Compromising Backtrack at the source is like trying to scratch the lens of a microscope and hoping that the technicians don't notice.
Jan
4
comment MiTM not working --rejected by router?
@user2945577 we can't help without a better description of the network configuration