Questions tagged [availability]
Availability is the property of ensuring that an asset can be used when it is needed. In other words, availability protects against the threat of denial of service. It is one of the three key security properties of an asset, along with confidentiality and integrity.
36
questions
1
vote
2
answers
116
views
How am I meant to back up my second factors?
I currently use MFA wherever possible. To do so, I mainly use the Google Authenticator app, as well as a YubiKey. However, I recently realized that backing these up is very, very difficult.
YubiKey
...
- 111
0
votes
0
answers
162
views
Risk to perform a Penetration Testing in production environment
Let's say I have a web server exposed on Internet that deals with confidential data and it has high requirements in terms of integrity and availability.
What are the risks to perform a penetration ...
- 101
-1
votes
1
answer
43
views
Can I use the CIA triad as a sliding scale wrt complexity?
I am looking for a device to explain the compromises that we make for extra layers of security.
For example wrt extra layers: communication like JWT encryption/signing and other sorts of encapsulation ...
- 129
0
votes
3
answers
607
views
Does the Time-To-Live (TTL) value of DNS records have any security implications?
I'm currently reading about resource record in the Domain Name System (DNS), in particular about the Time to live (TTL) aspect of start of authority records (SOA) records. It seems to me that the TTL ...
- 6,337
-1
votes
1
answer
108
views
Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]
I believe it would violate all the three aspects due to following reasons:
Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
- 3
15
votes
4
answers
4k
views
How can a service like Fastly have such an impact on the Internet? [closed]
Fastly WAF service was down a while ago, and it has affected a lot of major internet platforms and sites such as Amazon, PayPal, eBay, Spotify, HBO Max, the UK's main government website - Gov.uk, and ...
- 1,403
12
votes
4
answers
3k
views
Webserver DDOS protection without giving away private keys (https, tls, ssl)
What are the possible ways to protect an organization's web servers from a DDoS attack without giving away your web server's https private keys?
Many of the common solutions for DDoS protection of a ...
- 928
7
votes
2
answers
208
views
How should backups be tested in large offices?
I always hear people say "test your backups", but I have no idea how that is done in practice when you have to deal with complex infrastructures.
For personal backups it's easy to rely on ...
- 15.6k
-3
votes
1
answer
131
views
If an attacker can inject any code into an email client on a users computer, how can he compromise confidentiality, integrity and availability?
I have an upcoming exam for a Security course. The following question has come up a couple times in past exams and I could use some help formulating an answer.
Suppose a user downloads an unsigned ...
4
votes
1
answer
153
views
Practice question for Security+ that I think is wrong. Integrity vs availability
There is the following question on a practice test:
Which service are you addressing by installing a RAID array and load
balancer?
A. Confidentiality
B. Availability
C. ...
- 212
0
votes
1
answer
102
views
How do you securely give access to a Java App interactive console (Linux/GNU)?
I have a Java App running, which prints out messages into STDOUT and also has an active interactive console (also accepts STDIN), when the server has started up.
How do I securely give access to an ...
- 1,552
0
votes
3
answers
4k
views
Can importing an .ics file be dangerous?
Can there theoretically be any possible malicious code hidden in .ics files, which would steal your calendar data or something similar? For an example case, we'd be importing the .ics file into Google ...
- 1,552
1
vote
2
answers
191
views
Could the use of Cloudflare's free SSL feature result in loss of availability?
When using Cloudflare's free shared SSL feature, the certificate for your website is shared with dozens of others websites via the use of SANs (Subject Alternate Names).
Of course some of these ...
- 183
1
vote
4
answers
929
views
Schneier is telling me to write my bank security password and keep it in my wallet? Is that right?
Bruce Schneier Writes Down Passwords. So Can You
...
But how should people deal with all of this in the real world, or on line? "Relax," he says emphatically. Surprisingly for a security ...
- 639
1
vote
1
answer
139
views
Addressing availability element of CIA triad using technical controls
When looking at the availability element of the CIA triad, most definitions mention that availability is addressed through ensuring system up-time by using controls such as disaster recovery, business ...
- 155
1
vote
0
answers
121
views
Security model for availability of information
I have read about different security models that ensure the confidentiality and integrity of information such as the Chinese wall (confidentiality), Biba (integrity) and Clark-Wilson (integrity). ...
- 155
1
vote
1
answer
1k
views
Why touching a message with this text freezes the phone?
There is a certain text that, if appears on a text message and that message is touched by the user, causes the phone to freeze. The text is formed by many alternating right to left and left to right ...
- 135
2
votes
1
answer
3k
views
Nmap scan for Operational Technology devices
I want to scan a range of network with nmap to discover hosts but I know that depending on the scan, it can affect the integrity of OT (Operational Technology) devices, industrial devices like PLCs (...
4
votes
1
answer
156
views
Security requirement disk quotas
When reading about security measures for operating systems I found the recommendation that disk quotas should be used. I thought that is just a general IT requirement to ensure everybody got the same ...
- 149
4
votes
1
answer
4k
views
Authentication as CIA triad
As we all know, information security principles are stated as CIA triad, i.e., confidentiality, integrity, and availability. I wonder why authentication is not a part of CIA triad as being an ...
- 67
1
vote
1
answer
238
views
Security aspect vs Security goal
What is the difference between a security goal and a security aspect ? I know about the three network security goals Confidentiality, Integrity and Availability. But I do not know much about security ...
- 381
3
votes
2
answers
2k
views
Does HTTPS provide availability?
The paper On the Security of the TLS Protocol suggests HTTPS provides availability,
but I couldn't find the explanation. Is it provided because HTTP supports load balancers etc.? Or is it something ...
- 358
1
vote
2
answers
271
views
How to prevent corruption from ruining synced backups
I thought I was being clever keeping my password database stored on dropbox. This is because it's synced to the cloud and multiple computers. But when one got corrupted, I lost everything. (Ok I ...
- 10.1k
26
votes
5
answers
4k
views
Is unauthorised deletion an integrity or availability issue?
During a web application test I have discovered a parameter tampering issue that allows a user to delete comments left by other users. They can't modify the content of other users' comments, and they ...
- 32.9k
0
votes
1
answer
86
views
What patterns or practices exist to protect users from site admins deleting the user's information?
Here's my situation: Say you run a service online that stores information that users of the service would want to keep for a long time. This information could be notes, files, etc. but it is ...
- 876
22
votes
3
answers
4k
views
New denial-of-service vulnerability in TLS protocol, based on shooting down other users' sessions?
I think I have a new denial-of-service attack on TLS, and I'd like you to check whether this is a real vulnerability.
I recently learned about the proper way to drop an authenticated client session (...
- 393
3
votes
2
answers
636
views
iOS Unicode Notification Bug
Evidently, someone has discovered a Unicode bug in iOS, where if an app receives a specific Unicode sequence (infinitely-repeating Unicode code point), the OS will kill the Springboard as it allocates ...
- 1,460
1
vote
1
answer
184
views
Can all of Facebook's data be wiped out? [closed]
Is there a possibility that Facebook's entire data could ever be wiped out by a team of malicious individuals or even a government? Remotely or physically.
If so, how do you think they would go about ...
- 11
0
votes
1
answer
110
views
Security Engineering Potential Threat?
I've been working on some security engineering problems and there is no solution provided so if someone can clarify, would be great.
From the point of view of security engineering, which is not a ...
- 51
13
votes
1
answer
8k
views
Who is the creator of the CIA triad?
The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad.
As I am writing my master thesis, I am wondering to which resource I ...
- 253
0
votes
3
answers
1k
views
Security goals vs ITU-T security services
I am doing a course on cryptography, and there I learned that the major security goals are
Confidentiality
Integrity
Availability
Also I Learned that ITU-T provides 5 different security services
...
- 259
7
votes
4
answers
2k
views
Safest way for multiple users post to a single social networking account
Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of ...
6
votes
4
answers
516
views
How do you guarantee that you don't lose a keyfile?
I am toying with the idea of adding keyfiles to various things that I encrypt. However what's been keeping me from adopting them is guaranteeing that I don't lose the keyfile while still keeping ...
- 1,239
23
votes
10
answers
18k
views
In Healthcare IT, is a "break glass" mode to bypass access controls commonly required?
I've seen referenced in literature the need to have a "break glass" mode in Healthcare IT applications. In this mode, the access controls in an application can be bypassed for an emergency when it is ...
- 488
14
votes
5
answers
3k
views
Is there a digital "safety deposit box" equivalent?
Digital safety deposit boxes: do they exist? if yes, are (any|they) trustworthy?
There are many bricks and mortar financial institutions where one can rent a locked box in a locked room and be ...
- 501
13
votes
3
answers
4k
views
How does Diaspora work?
I hear all this hype about Diaspora being decentralized, but the only information I can find on their official website and the Wikipedia article is that several people can run Diaspora servers. The ...
user1633