meta user
network profile
|
Sep 27 |
comment |
HTML 5 postMessage PCI compliant You may want to check the source property as well: developer.mozilla.org/en-US/docs/DOM/window.postMessage ... I'd also ensure that an application firewall is in place to monitor and filter these requests. |
|
Sep 27 |
answered | HTML 5 postMessage PCI compliant |
|
Sep 21 |
comment |
What defines a programming language as useful for hacking? I can't tell you how much I hate debugging PERL though ... at least the Eclipse PERL debugger is pretty good :) It is good for knocking something out quick - but like LISP; it just hurts my brain. |
|
Sep 21 |
awarded | Critic |
|
Sep 21 |
comment |
What defines a programming language as useful for hacking? +1 since largely the capability for re-use of existing frameworks is the single largest benefit. I can certainly write apps to pen-test in any language, but not-having to reinvent the wheel (and not having to compile) gives directly executed languages a bit of a benefit |
|
Sep 21 |
comment |
Why is php not used for banking sites or for a banking transaction? Java and SQL server, or C# and Oracle are used often. The database is (or at least should be) irrelevant to the development language. |
|
Mar 5 |
asked | Changing windows client form values at runtime |
|
Dec 15 |
awarded | Yearling |
|
Nov 30 |
answered | What is your way to create good passwords that can actually be remembered? |
|
Nov 22 |
comment |
Best efficient windows hardening audit script Well, I can't think of anything solid out there other than MBSA for the moment, but it does look like MSFT and NIST are teaming up with some SCAP/OVAL cmdlets for powershell scap.nist.gov/events/2011/itsac/presentations/day2/… , services.nvd.nist.gov/jira/browse/SCAPDEV-1 |
|
Nov 21 |
comment |
Best efficient windows hardening audit script Is there any reason you can't use a third party set of tools? SCAP (security content automation protocol) is designed specifically to do this with various policies and benchmarks. |
|
Nov 17 |
answered | Any place where I can find some template or base documents for IT/Infosec Compliance? |
|
Oct 2 |
awarded | Nice Question |
|
Aug 30 |
revised |
Monitoring file access on Windows Fix typo |
|
Aug 30 |
revised |
Monitoring file access on Windows Fix typo |
|
Aug 30 |
answered | Monitoring file access on Windows |
|
Aug 29 |
comment |
Password entropy in layman's terms Obligatory xkcd.com/936 |
|
Aug 29 |
comment |
The Creation of Secure Software Development Environments @Rory & DW. Thank you for the follow ups - and I agree with both of you in that isolation is one of a myriad of protections that needs to be in place. My shortcoming is in finding reference guidance and frameworks for this type of isolation. I'd assumed that I'd need to build much of the framework myself and the issue is finding whitepapers or industry research to support it. |
|
Aug 29 |
comment |
The Creation of Secure Software Development Environments Thanks for the input this.josh. I agree that this is a difficult goal, but there are technolgies that can assist as well. A remote developer could be on a laptop secured w/ checkpoint (or something like it to ensure no config changes) that tunnels into the dev system via VPN and actually develops on a remote desktop session (just 1 idea). Most companies certainly wouldn't pay for the additional overhead, but I have been on DoD projects where it was a contract requirement - so I know that the need (at least to some degree) exists for a common governance and design mechanism. |
|
Aug 28 |
comment |
Accessing a site (which is) under a DDoS Are there any external firewalls that do not have IP addresses registered to an-example-site connected to the network (that Alice might use to VPN to the internal side of the network for access to the site)? |
