Questions tagged [confidentiality]

Confidentiality is the property of maintaining the secrecy of an asset. In other words, confidentiality means protecting against the threat of disclosure. It is one of the three key security properties of an asset, along with integrity and availability.

Filter by
Sorted by
Tagged with
0 votes
0 answers
26 views

Can I use the CIA triad as a sliding scale wrt complexity?

I am looking for a device to explain the compromises that we make for extra layers of security. For example wrt extra layers: communication like JWT encryption/signing and other sorts of encapsulation ...
user avatar
  • 131
2 votes
1 answer
195 views

Can my ISP know that I have more than one Google Drive account?

So, I have 2 Google Drive accounts. Let's say Drive A and Drive B. If one day I login/upload to Drive A then log out, then login/upload to Drive B, can they notice that I have 2 different accounts? Or ...
user avatar
0 votes
1 answer
77 views

How to securely hash sensitive data and make the hash public, while preventing an attack by someone who know the structure or some part of the data?

In a nutshell, I need: to hash a file and to make this hash public, to be able to prove data integrity when sharing the data privately with a trusted third party. to choose the right hashing method ...
user avatar
  • 3
0 votes
0 answers
302 views

Should I be worried about Ignoring query from non-local network in dnsmasq?

I am using a DNS forwarder, it's not open to the WWW (runs only in the LAN) and in the dnsmasq logs I noticed something off: Ignoring query from non-local network Has my network been breached? ...
user avatar
4 votes
1 answer
140 views

Does "row-level security" actually serve a security purpose?

Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards. It's supported by most major relational databases, including PostgreSQL, Microsoft ...
user avatar
  • 5,298
0 votes
0 answers
28 views

Are IDS/IPS already implemented on Google Cloud?

I have a partner that is asking "Do you use breach detection/prevention tools?". I host my service on managed hosting (Heroku) and currently migrating to Google Cloud. Should I be using &...
user avatar
  • 101
0 votes
2 answers
65 views

connecting to Windows Admin Center using port 443

I want to use Windows Admin Center, but I don't want to install a SSL certificate. If I were to forward packets from 80 to 443 using firewall rules would they automatically be encrypted?
user avatar
  • 1
0 votes
1 answer
78 views

What hidden metadata might be embedded in a PDF that is not visible "to the naked eye"?

I have edited a PDF file in Acrobat, which left some metadata and I am wondering: What metadata might be possible to discern from the end file if I were to send it to external parties? What actions ...
user avatar
  • 101
0 votes
1 answer
89 views

Can this logic with regard to checking Reverse DNS records be flawed?

For my web app, I hardcode a reverse DNS detection for common web crawlers. And for detecting them I use their Reverse DNS, which I always check whether it includes i.e. google.com. My questions would ...
user avatar
  • 190
0 votes
1 answer
126 views

Why can't you give special security cookies to a specific crawler so that they could securely crawl the website?

In the current day and age we have the problem of malicious/spam crawlers and similar concerns. My suggestion would be implementing cookie support for crawling and by that I mean giving specific ...
user avatar
  • 190
0 votes
0 answers
86 views

Can SVG be a potential threat for tracking scripts and similar?

Since SVG files can have JavaScript, which would get executed is it a potential threat for malware, tracking scripts and similar stuff?
user avatar
  • 190
1 vote
0 answers
175 views

Do anti-cheat software actually "patch" the UEFI firmware on your motherboard?

I've recently read about the new game called Bloodhunt containing an Anti-Cheat, which had a bug, in which the anti-cheat service would stay installed even though the game is removed. The top Steam ...
user avatar
0 votes
1 answer
170 views

ASP.NET Core - are files put in the Shared folder under Pages (where the Razor pages reside) publicly accessible?

Are files put into the Pages/Shared folder public to the whole WWW if the website is hosted publicly? I am asking since I want to implement a partial view load thru a controller and want to know ...
user avatar
  • 190
0 votes
1 answer
127 views

Is malware a threat vector for REST APIs?

Let's assume we have REST API in which you accept GET and POST HTTP requests without the ability to execute files. Is it possible to execute malware in this scenario? Would there be any justifiable ...
user avatar
0 votes
0 answers
78 views

In what order should you create the partition table and a LUKS container?

My goal is to fully encrypt my USB drive with LUKS. What's the correct order of encryption? Should I create the partition table or the LUKS container first? Motivation behind would be greatly ...
user avatar
  • 1
10 votes
9 answers
4k views

Can proprietary protocols be considered as secured?

I am new to the info-sec industry and was recently tasked with evaluating the communication protocols used by my various subsystems. So it was stated in the requirements that the systems have to ...
user avatar
  • 109
-1 votes
1 answer
100 views

Consider a Fraudulent bank website, would it violate all the aspects of the CIA triad or any one? [closed]

I believe it would violate all the three aspects due to following reasons: Confidentiality: Since the website is obviously a scam, in case any person/user registers it, the data of the user would not ...
user avatar
0 votes
2 answers
194 views

How do I do asymmetric/hybrid encryption in practice?

Question I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated. What do ...
user avatar
  • 175
1 vote
1 answer
169 views

Are hosted bare-metal servers more secure than VPS against unauthorized disclosure?

Our small company needs to store sensitive data in the cloud. We are debating VPS's or rented bare-metal servers due to cost. Our threat model includes malicious sysadmins working at the hosting ...
user avatar
0 votes
0 answers
83 views

Confidentially seperating web content under single IP address

I am interested in exposing web content to strangers on the internet (Reddit, Discord, ..). This content I wish to reside on the same web server under which personal web content resides. (None of this ...
user avatar
  • 1
1 vote
2 answers
620 views

Is it OK to hash sensitive data, given hashes provide no confidentiality?

Confidentiality is the property of a message whereby no one but the person who knows a secret (let's calle it K) can read the message. Hashes do not provide confidentiality (data is destroyed, you can'...
user avatar
0 votes
0 answers
22 views

Will Internet provider know what sub-page I visited on a site? [duplicate]

Let's say in my address bar I see such link: Privatebin URL/key interception? Can somebody besides server and me know that I'm visiting not just security.stackexchangec.com but excactly ../questions/...
user avatar
  • 245
2 votes
1 answer
175 views

how message authentication code share keys?

How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...
user avatar
7 votes
2 answers
729 views

Can Google access data in their Confidential Computing VMs?

A cloud operator such as Google can take a snapshot of a normal VM. This includes CPU state, RAM and disk. This can then be copied to another physical and resumed there. Or it can be analyzed off-line,...
user avatar
  • 309
2 votes
1 answer
509 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
user avatar
  • 190
1 vote
0 answers
192 views

Keeping data confidential from the system administrator

Problem How do I ensure that I cannot access confidential data manually through the database? Practically speaking, this is a firestore database on google cloud, and I have access to the administrator ...
user avatar
0 votes
0 answers
428 views

Passing confidential data to an IFrame

There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to ...
user avatar
  • 198
0 votes
1 answer
131 views

Is using full TLS suite in all communication scenarios a defacto standard?

Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad. ...
user avatar
2 votes
1 answer
106 views

Alternative approaches to letting users identify themselves while maintaining privacy

This is kind of a weird question maybe, so let me explain a little background first that I hope is relevant. I work as a Developer/Analyst for an organization that operates in a federated model with ...
user avatar
  • 123
0 votes
0 answers
272 views

What are the main differences between a covert timing channel and a covert storage channel?

I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages. Is ...
user avatar
  • 13
24 votes
4 answers
11k views

Why define CIA in security like this?

As we know CIA of the demand for security means: Confidentiality Integrity Availability I don't understand why define the "Integrity" and "Availability`, If we make a plaintext Confidentiality, the ...
user avatar
  • 915
0 votes
1 answer
762 views

Forced to install certificate on my laptop when using company WiFi. Risk? [duplicate]

My company has a 'bring your own device' policy. You connect your device to the WiFi, and then open a citrix environment through a web portal. Basically, everything inside the citrix env is company-...
user avatar
  • 103
4 votes
1 answer
6k views

How do you securely delete httpOnly cookies previously used for login?

I am using Angular 8 with Node.js (Express.js) to make a login system. It needs to be secure. I have set the cookies using httpOnly:true, which contain a JWT token and it should be deleted by the ...
user avatar
  • 190
2 votes
0 answers
95 views

Does photo fingerprinting (using metadata) allow to search all photos on internet made by the same user (privacy issue)?

Browser fingerprinting is well-known: since a client gives many HTTP attributes/Javascript attributes during a website visit, the probability that two users have the same exact values for all this ...
user avatar
  • 931
1 vote
2 answers
169 views

How to Prove you created IP using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
user avatar
  • 548
1 vote
1 answer
126 views

What's the safest way to store data on a server abroad? [closed]

A very good friend of mine is a journalist in a country where the state is becoming more and more despotic. She would like to store critical data on a server abroad. Is there any service that would ...
user avatar
  • 113
2 votes
2 answers
101 views

MongoIDs and confidentiality

Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually ...
user avatar
0 votes
3 answers
3k views

Can importing an .ics file be dangerous?

Can there theoretically be any possible malicious code hidden in .ics files, which would steal your calendar data or something similar? For an example case, we'd be importing the .ics file into Google ...
user avatar
1 vote
2 answers
793 views

What is the difference between concealment and secrecy in context of confidentiality?

I just started studying up for the CISSP and am having trouble understanding few concepts. This is regarding confidentiality, Below are some of the aspects of confidentiality Sensitivity Discretion ...
user avatar
3 votes
2 answers
173 views

How do ERP systems track classified business activity?

One of the selling points of Enterprise Resource Planning systems like SAP or Oracle E-Business Suite is their claim to give management visibility across the business, by aggregating (or at least ...
user avatar
0 votes
3 answers
351 views

I found a website that lists all the email addresses of Facebook users in UK. What do I do? [closed]

I came across this very peculiar website that supposedly lists the email addresses of Facebook users in the UK. I will not be posting the URL for obvious reasons. I entered a couple of emails to see ...
user avatar
0 votes
0 answers
114 views

When sharing confidential information, which is more secure share via Outlook vs store on Sharepoint then provide access?

I'm trying to figure out what is good practice and what is more secure for my small team. I wanted to set a standard or governance on how to share confidential information within our team. One person ...
user avatar
  • 101
0 votes
1 answer
522 views

Why do I see bridged devices when monitoring Wi-Fi activity?

I'm trying to figure out what information about my infrastructure can leak through Wi-Fi. I ran Kismet and was surprised to see that a few minutes later, Kismet displayed not only the MAC addresses ...
user avatar
2 votes
2 answers
184 views

Can the System Admin (the main guy with all the permissions) decrypt confidential data from the server?

We have a company Foo, we have user data all encrypted that are stored in some kind of a database. Correct me if I am wrong, the encryption keys have to be saved in the system. Now say the admin ...
user avatar
2 votes
2 answers
315 views

Is there any 'Open Enrypted File Container' Format?

Tools that create 'encrypted file containers' use open encryption standards like AES to encrypt container contents, however the container format is proprietary, I am guessing, so need the same tool to ...
user avatar
1 vote
1 answer
499 views

Why " Simple Integrity Property" axiom of Biba model protects data integrity?

I am reading CISSP and more specifically the Biba model. Biba has some basic properties: The Simple Integrity Property states that a subject cannot read an object at a lower integrity level (no read-...
user avatar
  • 329
1 vote
2 answers
174 views

What are the security implications of losing a paper calendar?

Assuming I have a paper calendar (organizer) with the following information on it: dates/locations where I have been and where I'm planning to go phone numbers and e-mail addresses of a few people my ...
user avatar
  • 1,139
2 votes
1 answer
672 views

Does steganography ensure confidentiality?

Can we say that steganography ensures confidentiality? I think it does not ensure because it is based on the security through obscurity and then it does not respect Kerckhoffs's principles, but the ...
user avatar
  • 55
0 votes
0 answers
146 views

Why do people redact MAC addresses? [duplicate]

What are the security implications of sharing a MAC address online? How important is it really, to redact this information; and why? I see it a lot, and I'm in the habit of doing it myself. 1. ...
user avatar
  • 1,639
0 votes
2 answers
147 views

Is there any way to track the status of a document sent to an external entity?

I'm wondering what the capabilities for document (PDF/DOCX/XLSX/PPTX) tracking are , specifically to determine whether a client has broken a non-disclosure agreement. Here's a scenario: Service ...
user avatar
  • 736