Questions tagged [defense]

Defense is the use of security countermeasures to protect the integrity of the information assets in an IT system and/or infrastructure.

Filter by
Sorted by
Tagged with
1 vote
1 answer
69 views

Sharing the key to a password vault securely

We have an application that holds a bunch of passwords in an encrypted vault for various purposes. What is the best practice for storing the key for that vault? There feels like there's a ...
Hovestar's user avatar
  • 113
0 votes
1 answer
87 views

Does self-signed encryption certificate violate "no multi-use keys" principle?

Say that I have generated an RSA keypair, which I intend to publish only for use with RSA-KEM; I can see that this is provisioned for: The intended application for the key MAY be indicated in the key ...
JamesTheAwesomeDude's user avatar
0 votes
1 answer
289 views

What are the best practices to safely store OAuth2 tokens in a database?

I'm building a website with Patreon integration and I have identified the need to store Patreon user's OAuth2 token in the database. I'm wondering what's the best way to do that, security-wise. Some ...
Vilx-'s user avatar
  • 1,030
0 votes
1 answer
81 views

OS/DB Hardening Checklist Drafting Process

We are looking into reviewing our organization OS/DB hardening checklist (done by predecessor). We're aware that there are various benchmarks out there like CIS & STIG to guide on that, and the ...
nlks's user avatar
  • 3
0 votes
3 answers
128 views

Security in depth vs security theatre

If some security measure serves only to add an extremely small barrier to an attack, are there generally accepted principles for deciding whether that measure should be retained? Does defence in depth ...
benjimin's user avatar
  • 155
0 votes
2 answers
164 views

How do you detect attacks on Intel ME firmware and the AMD equivalent?

Since there are quite a few exploits of Intel ME firmware in the CPU (same applies to AMD), I would like to know what SIEM solutions are there for detecting these kinds of attacks. To be more exact, I ...
Sir Muffington's user avatar
1 vote
1 answer
432 views

Is it still recommended to block Living Off The Land Binaries (LOLBins) in Firewall?

https://lolbas-project.github.io/ Realistically, do we still need to block cmd.exe or certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only ...
user avatar
1 vote
1 answer
87 views

Reuse credentials if same data in same security environment

We're managing a shared hosting environment of Wordpress websites on a web server. Each site has its own database password and FTP password, both are randomly generated and stored in AWS ...
jdog's user avatar
  • 355
14 votes
6 answers
4k views

Is it acceptable to exclude folders in antivirus?

A technical problem has arisen, and the vendor's first suggested solution is to exclude the program's folders from our antivirus. There are multiple reasons I am hesitant to do so: Primarily: If a ...
Seymour Guado's user avatar
2 votes
0 answers
59 views

Normative reference for a web application disclosing existing values of integration secrets to users

In a web-based SaaS product, one of the configuration pages allows users to set credentials for system-wide integrations with other products. These include usernames, passwords, and API secrets. The ...
rmc47's user avatar
  • 121
0 votes
2 answers
160 views

Is not Electrum's Seed Word Autocomplete a Theoretical Security Risk?

As the image below shows, when you try to restore an existing wallet from a seed (a sequence of 12 words), the program offers some autocomplete suggestions. Though I'm sure the risk is purely ...
user avatar
0 votes
0 answers
91 views

Are there any security architecture patterns in the same way there are software design patterns (GOF)?

So I've been googling around and couldn't find an answer to my question (I don't discount the option that I could be asking the wrong question after all). I see there is a question that deals with ...
4d4143's user avatar
  • 133
1 vote
1 answer
166 views

Is "time locking" a good strategy for protecting data with HSMs?

I've read several times that many HSMs support configurable rate limiting on cryptographic operations, as a way of protecting against a hacker that compromises a server that has access to the HSM. So ...
bnsmith's user avatar
  • 87
2 votes
1 answer
222 views

How to prevent small mistakes that have massive impact?

I frequently have very personal files temporarily on my virtual desktop. I sometimes download a new program, which is going into a VM. Before sending it in there, I tend to VirusTotal scan it. I load ...
M. Moyna's user avatar
1 vote
2 answers
219 views

Can some HSMs send requests to other servers before performing an encryption/decryption operation?

In various discussions of Security Architecture, I have read that HSMs can be configured with rate limiting on the number of encryptions/decryptions that can be performed in a given amount of time. If ...
bnsmith's user avatar
  • 87
0 votes
1 answer
351 views

Using an HSM to protect encrypted data even when a server is compromised

Imagine a system architecture where an API server is able to send a request to an HSM, and the HSM is able to decrypt some data for a particular user/customer, in order to serve some hypothetical ...
bnsmith's user avatar
  • 87
0 votes
0 answers
113 views

What OS do I focus on when learning Cyber Defense?

After some time in the Cyber Defense field, I am noticing that there are different learning paths to take depending on the OS you choose (for example you can learn how to use PowerShelll and lots of ...
Néstor Llop's user avatar
1 vote
3 answers
962 views

Why is it not recommended to permanently use the root account for all tasks?

Yes, I did read this answer: https://apple.stackexchange.com/questions/192365/is-it-ok-to-use-the-root-user-as-a-normal-user/192422#192422 But I still fail to understand the reasoning behind this ...
gaazkam's user avatar
  • 5,945
1 vote
0 answers
112 views

How can I best obfuscate surveillance against my browser? [duplicate]

I mostly use the Tails browser, but I also use Firefox in Fedora with several add-ons such as TrackMeNot, HTTPS Everywhere, uBlock Origin, NoScript, and Fingerprint Detector. I would like to obfuscate ...
Patriot's user avatar
  • 297
1 vote
0 answers
151 views

What can I do to get Google, Facebook, Microsoft, and Twitter out of my Life as Much as Possible? [closed]

Now that those four are in the censorship business and cooperate to surveil and exclude, I want to do more to get them out of my life. No Facebook, no Twitter, no YouTube, no G-mail, no Microsoft, no ...
Patriot's user avatar
  • 297
0 votes
1 answer
282 views

How does one detect and deter golden SAML attacks?

How does one defend, detect and deter golden SAML attacks?
Nathan Aw's user avatar
0 votes
0 answers
26 views

Does "Security By Obfuscation" have any place in good security practices? [duplicate]

One thing I've had hammered into me by pretty much every security expert I've talked to is that security by obfuscation is not a substitute for actual security measures. However, it has me wondering; ...
Bitsplease's user avatar
0 votes
2 answers
268 views

Prevent users from easily changing the backend API URL of a desktop application

Is it considered a good security practice to prevent users from easily changing the backend URL of a desktop application that connects to a backend server with an SSL protected HTTP API? One concern ...
mrucci's user avatar
  • 121
0 votes
1 answer
158 views

Internal HTTPS recommended security practices

So I'm by no means a security expert. I'm just a recently graduated software developer who is working on a contract project and I want to ensure I'm taking appropriate security measures for my client. ...
Jack's user avatar
  • 101
1 vote
1 answer
175 views

Directories enumeration by errors. CVSS3.1 and remediation

Let's consider this scenario. If I browse to https://www.example.com/existentdirectory the web application shows this error "directory listing is denied". If I browse to https://www.example....
Maicake's user avatar
  • 567
1 vote
0 answers
100 views

Security Team and Security in a small-medium organization/startup [closed]

How should one structure and how should a Security Team work in an agile organization (100 devs). Found this article: https://kislayverma.com/organizations/independence-autonomy-and-too-many-small-...
dev's user avatar
  • 997
-3 votes
1 answer
1k views

How am I supposed to check Defender's capability when it trusts me blindly after I mark a test malware file as "allowed"?

With enormous amounts of fighting with Windows/Microsoft Defender, I finally managed to download the "test virus" file from https://www.ikarussecurity.com/en/private-customers/download-test-...
K. Hodgens's user avatar
0 votes
1 answer
186 views

How to guarantee only my client application can request a nonce?

I have a web site and a service in a server. I'm developing the "Register User" and "Login" components. I've searched on the internet and I've found two protocols to login user ...
rmmariano's user avatar
  • 103
1 vote
2 answers
967 views

What is the best way to mitigate malicious bot traffic on a Node Express server?

My public website is getting a lot of get requests to endpoints like "wp-login.php", ".env", ".git/HEAD" and many others. This seems to be a non-trivial portion of my website's traffic and I'd like to ...
Glen Pierce's user avatar
0 votes
1 answer
643 views

How to store encrypted notes in a public git repository?

I save my notes in a git repository in plaintext (markdown). Currently, the remote repository is another computer in my appartment. I am thinking about moving this remote repository to a remote server....
uuu's user avatar
  • 385
1 vote
0 answers
146 views

Whether ISPs provide path of Spoofed SYN Flood attack is the only way to trace the attack source?

The attacker spoofs SYN packets to attack a server. In this document: Spoofed Attack: A malicious user can also spoof the IP address on each SYN packet they send in order to inhibit mitigation ...
244boy's user avatar
  • 935
0 votes
1 answer
435 views

Is my Java code still vulnerable to SQL injection? [duplicate]

We have a Java web application that was vulnerable to blind SQL injection attacks. Our developers fixed the code by using the replaceAll() function to convert single quotes to two single quotes. I am ...
b.k's user avatar
  • 3
3 votes
3 answers
386 views

Why is a fully-patched OS less important than AV?

How to explain to traditional people why they should upgrade their old Windows XP device? <- The interesting point made in the highest upvoted answer to this Q is that a fully patched OS is largely ...
gaazkam's user avatar
  • 5,945
1 vote
0 answers
40 views

Name of security measure that shows user a personal word / phrase / drawing [duplicate]

I remember a security measure I've seen on a few sites in the past against phishing, but I don't know what it's called. When the user logs in, or just inputs their username, the site shows some kind ...
Ram Rachum's user avatar
  • 2,058
3 votes
1 answer
470 views

How to detect backdoor/root shells?

Let's assume I'm a user with root access to a machine and I'm a legit user. My machine/server runs Linux. I'm not very familiar with defensive security (I mainly practice offensive). Sometimes, ...
ChocolateOverflow's user avatar
3 votes
1 answer
286 views

What do I do if I catch someone doing a physical pentest? [duplicate]

This question was primarily inspired by this (related) question, but is about the other side of the equation. I'm a security engineer at Medium Sized Company, Inc. We recently hired John for a ...
Kaz Wolfe's user avatar
  • 382
2 votes
2 answers
1k views

How often, if at all, should I rotate my passwords?

In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
user avatar
103 votes
19 answers
16k views

How to explain to traditional people why they should upgrade their old Windows XP device?

This is an issue I'm recurringly facing: older people from my family (or people who my family members know) can be surprisingly reluctant to apply most basic security measures when they're using their ...
gaazkam's user avatar
  • 5,945
3 votes
1 answer
574 views

How secure is connecting to the Internet via Windows XP (or even older) nowadays only for e-mail?

While trying (and failing) to convice a certain older person who wanted me to "fix" their ~20 years old PC that they should not be connecting to the Internet with whatever version of Windows they have ...
gaazkam's user avatar
  • 5,945
3 votes
2 answers
455 views

How do attacks on web browsers succeed? [closed]

We all know that attacks on web browsers are entirely possible. This includes attacks such as drive-by downloads, MITB (man-in-the-browser) attacks and keylogger browser plugins/extensions. However, ...
rshah's user avatar
  • 153
1 vote
2 answers
1k views

Most secure algorithms for KDF and Public Key Encryption [duplicate]

I'm developing an application which will need to derive a private/public key pair from a user provided password, and then use the public key to encrypt some text (up to 1000 characters in length) such ...
vikarjramun's user avatar
1 vote
0 answers
98 views

OS and Password Manager - How to Manage Multiple Credentials

This question is about best practices, and not necessarily my how I manage my current setup. I have these two scenarios, macOS Mojave with KeepassXC, and Windows 7 + Android 8.0.0 with SafeInCloud. ...
TeckFudge's user avatar
3 votes
3 answers
323 views

Ensuring all network services on a device use strong TLS cipher suites

(This is hypothetical, but based on a real-life problem I've had) Context: I am developing an (embedded) device which includes a few exposed network services. I'm responsible for security, not ...
Josiah's user avatar
  • 241
1 vote
1 answer
4k views

How to block or stop redirection with window.location?

I need to block redirection using window.location on my site. Some hacker has injected a stored XSS script into my site: if(my_username != 'Name') window.location = 'https://the url'; Now each ...
user avatar
0 votes
1 answer
561 views

Preventing host discovery in network

With tools such as Fing (Android app) and netdiscover (Kali Linux tool) its possible to get all connected devices in network. How it's possible to prevent host discovery in a network?
Mario's user avatar
  • 23
-2 votes
1 answer
293 views

How to protect my site from XSS

I own a chat site {https://trixac.com}. It uses BoomChat's code. Recently I banned a troll and now he is back and hes running XSS injections against my site and it's working for some odd reason. I've ...
user avatar
2 votes
2 answers
853 views

If I turn off Windows Defender Credential Manager off in Windows 10 so I can run a virtual machine in Virtual Box, is that a bad idea?

My processor is supposed to support virtualization: cpu.inf:5f63e534115a322c:IntelPPM_Inst.NT:10.0.17134.765:ACPI\GenuineIntel_-_Intel64 ACPI\GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_37_-_INTEL(R)_CORE(...
leeand00's user avatar
  • 1,431
6 votes
2 answers
371 views

Suppose antivirus provider turned malicious: What do we do?

It was recently reported that the hacking group Fxmsp "...claimed to have secured access to three leading antivirus companies," and that they "...extracted sensitive source code from antivirus ...
I say Reinstate Monica's user avatar
6 votes
2 answers
3k views

CSRF token unique per user session - Why?

OWASP recommends that a CSRF token should be unique per user session. What is the attack vector or reasoning behind that? How could an attacker exploit a web application that does not invalidate the ...
Martin Fürholz's user avatar
0 votes
0 answers
301 views

How do hacking groups get a license anonymously for threat emulation software like Cobalt Strike?

I've seen that a lot of hacking groups replicate techniques and attacks from red teams using software like Cobalt Strike and Powershell frameworks for offensive security and red teaming like Nishang ...
EQT_STRIKE's user avatar

1
2 3 4 5 6