Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [defense]

Defense is the use of security countermeasures to protect the integrity of the information assets in an IT system and/or infrastructure.

1
vote
2answers
54 views

Does red-teaming encompass the entire skillset of a blue-teamer?

Currently I am potentially facing impostor syndrome in regards to the role and skillset of blue team members (defence) and red team members (attack). I personally specialise in defence capabilities, ...
0
votes
0answers
11 views

Other standards like TPM and “Measured Boot” for Security Analysis [closed]

I just learned about TPM and Measured Boot (but I'm interested cross-platform). It sounds really useful to take measurements of key devices starting from a trusted base (BIOS) and going all the way to ...
1
vote
1answer
74 views

Explaining malware avoidance tactics

Most "how tos" regarding malware list this: Install Antivirus software. Install latest antivirus software. Run antivirus software regularly. Install latest operating system. Install any patches to ...
19
votes
4answers
5k views

Is strategic cyber-warfare feasible today?

Cyber attacks that target a nation's infrastructure are a documented fact and as such a danger that political and military leadership across the world needs to worry about and act proactively. These ...
0
votes
1answer
45 views

SSH: Best practice for PublicKey Authentication from multiple Devices

I have a Server I want to access via ED2559 PublicKey Authentication. How would one do it so it is as safe as possible from multiple devices? Should I add multiple PublicKeys to my Server or should I ...
0
votes
3answers
96 views

Is it better to rate limit API requests based on UserId or IP address for authenticated users?

I'm thinking of rate limiting anonymous requests based on IP, but for users with a valid authentication token, I can't decide if it's better to log and rate limit requests based on their UserId or IP ...
27
votes
5answers
8k views

I detected someone probing my site for weaknesses, what can I do about it? [duplicate]

My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
2
votes
1answer
67 views

Is there any defense against this kind of attacks? (key comparison attack, or something)

is there any defense against this kind of attack? https://youtu.be/7U-RbOKanYs?t=974 I know someone who uses a password encryption hashing that generates the same length of keys as in this video and ...
1
vote
2answers
122 views

Trip to China - safeguarding phone and laptop

I am going to China for a 2 week vacation in a month I will be taking a Google Pixel with a Verizon SIM and using it while there. I assume that if I don't use a local SIM, it would be difficult for ...
1
vote
1answer
45 views

Is there any way to estimate the safety of arbitrary binaries, which are usually released with unofficial patches?

Frequent scenario: An old game is released on GOG / Steam. It proves to be incompatible with new Windows systems. (Crashes, game breaking bugs, fps of 0.5 and the likes) An unofficial patch is ...
4
votes
3answers
419 views

How much of a visible deterrent is IT security?

While looking at this question, one of the comments made me think. In the comment, the user asserted that "one must invest a lock that cost $40, the insurance company just want to make sure that it ...
89
votes
10answers
18k views

Does it improve security to use obscure port numbers?

I recently started a job at a small company where the CTO prefers to host SSH services at obscure, high numbered ports on our servers rather than the well known port 22. His rationale is that "it ...
5
votes
3answers
1k views

How to protect our server from brute force attack? [closed]

One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
3
votes
1answer
92 views

Duo Security forgot password workflow

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking ...
0
votes
2answers
179 views

encryption - how to secure files - decrypting exposes them on ssd

Let's say I have an encrypted file. Now I decrypt it but since my computer only has ssd, i decrypt it on the ssd drive. Say, I make changes or I finish using the decrypted file so I encrypt it again. ...
13
votes
1answer
4k views

Is my iPhone being targeted by the US Department of Defense?

Below is a screenshot of a text message my mobile device received within the past hour. It contains the text "6.216.198.5:8006/Y/0329235420500012000110000" from the number "1111301000". I am curious ...
22
votes
2answers
1k views

Rude neighbor with PineAP or something similar

For the past week or so I've been having problems with wifi in my house, and it appears that my neighbor set up a Pineapple or something similar that is running a known beacon attack and/or Karma/...
0
votes
1answer
177 views

With an IPS in place, do we really need firewalls?

I was reading the article "Do you need an IDS or IPS, or both?" on TechTarget. While reading the author's explanation of IPS this question hit me. If an IPS is a control tool that uses a set of ...
1
vote
1answer
1k views

Do I need to disable TLS 1.0 altogether? [duplicate]

We recently went through a third party review of our systems where the consultants have reported a finding that we have TLSv1.0 enabled. In the report they are referring to this NIST document which ...
0
votes
2answers
111 views

Is restricting access to file content a way of securing sensible but day to day needed information from 3rd party software?

To clarify this directly. I mean what if every (even malicious) 3rd party software running on this OS gets never access to its data and rather 'describes' what to do with? So for example 'here at ...
12
votes
2answers
3k views

Is there a test for KRACK (devices and routers)?

After Heartbleed was announced, a number of tests popped up that let me test if a server I was connecting to was patched, unpatched or unknown. For example, https://filippo.io/Heartbleed/ Is such a ...
-1
votes
1answer
77 views

Why aren't more wifi points compromised? [closed]

Especially in light of the recent KRACK problem. Wifi has been compromised before; and undoubtedly it will again. So I have to wonder, why don't criminal organizations travel around major cities, ...
1
vote
6answers
185 views

What is the best way to defend against an already comprised computer with a keylogger that is active?

I'm curious to what are the possible solutions to defending against a comprised computer with a key logger installed. Assume you had to login to a site with a user / password and there's no way to ...
4
votes
2answers
62 views

Is There an Analogous Agency to OSHA but for Bad Data/Security Practices?

I ran into an old coworker and we were both discussing some of the bad practices our old workplace(that dealt with very sensitive data) had and looking back some of them are really bad and probably ...
0
votes
1answer
63 views

Best practices with respect to hard drive reconstruction

I would like to be able to store encrypted information on my computer, that no one else is able to read without the right password, even if they have complete access to the computer. There are of ...
1
vote
1answer
349 views

IAT Hooking questions?

I have researched IAT hooking by malware and i still have a few questions: If the IAT of the program in memory is different to the IAT of the static program (before it has been ran) does this imply a ...
19
votes
4answers
3k views

What lessons can be learned from the latest spate of Ransomware attacks? [closed]

I'm not sure this is the right place, but figured people would find it useful if they aren't too familiar with security policies and general best practices. There is a lot of information out there, ...
2
votes
1answer
569 views

SIEM Alien Vault recommended method for muting noise

I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that ...
0
votes
1answer
74 views

How to enforce software updates on workstations?

There are many workstations on the company network with various kind of software installed: web browsers, OpenVPN clients, remote management agents, encryption utilities and other tools. Some of the ...
0
votes
2answers
1k views

How to detect if someone is using airmon-ng [Aircrack-ng] in my wi-fi network

Using the Linux Kali distribution, I was able to get the password from my wifi network using the airmon-ng [Aircrack-ng] tool. However, how can I find out if someone is doing this on my network?
3
votes
1answer
109 views

Ads on Checkout a Bad Idea™?

Is it a categorically bad practice to run third-party aggregated ads on a checkout page where sensitive information is entered? This sends of all kinds of alarm bells for me, but I've had a ...
1
vote
1answer
62 views

Best practice / Risk Assessment payment websites

I have two websites which do both accept payments on a subdomain. The subdomain is an independent system from the main website. I have a question regarding the best practice to decide which of the ...
1
vote
1answer
85 views

How to use encrypted internal strings and config? [duplicate]

I was reading the CIA leaked documents on wikileaks, I saw in their "best practices" section that it was advised to encrypt all strings and config information and to de-crypt in memory when needed. ...
0
votes
1answer
98 views

Network Defense- White listing IPs/Ports

If I had a typical home user machine (google, email, youtube, no ssh/ftp, etc...) that had a dynamic iptables white-list that was dynamically updated with IP addresses that have been legitimately been ...
-1
votes
1answer
349 views

How many security questions should be asked? [closed]

We currently use 5 security questions but Operations team is asking us if we could lower down to 3. With that,What is the best practice for this one? How many security questions should be asked?
8
votes
5answers
315 views

Could ransomware be stalled while encrypting?

I have been reading about ransomware, and I was wondering if it could be defended against by having certain "trap" files on a drive. Sometimes I look through Code Golf and am thoroughly impressed by ...
1
vote
1answer
103 views

How to convince someone to use layered security?

Layered security, also known as layered defense, describes the practice of combining multiple mitigating security controls to protect resources and data. How to convince someone to use layered ...
1
vote
2answers
282 views

Relay attack against Captcha

I am implementing a website that included my own text Captcha (I do not use any Captcha service - like reCaptcha). the Captcha code serves each challenge (i.e. image) only once for both display and ...
2
votes
1answer
302 views

Potential HTTP Host header attack from malicious IP, what does it mean in practical terms for me? Should I be concerned?

I'm asking about an error I've got a few times in the past day, outside of the theoretical. I'm wondering what may be actually happening in my case. The error comes from Sentry, on my ubuntu/nginx/...
0
votes
1answer
169 views

Locking down Ubuntu

A competition is coming up at my school for securing computers and my OS for this challenge is Ubuntu. I'm trying to think of things to add to my list of security measures and things to look out for. ...
1
vote
3answers
80 views

“Green is good” and related security advice

From Citizen's bank login page: Should my browser address bar have a "green" indicator when I use Online Banking? Yes. As an added measure, Online Banking gives you the capability to easily ...
1
vote
1answer
666 views

How to validate CSRFGuard token on the server side?

I have implemented the OWASP CSRFGuard library to protect my application against CSRF attacks. I'm using the CSRFGuard JavaScript file and servlet to inject CSRF tokens in all the Ajax requests. So ...
1
vote
3answers
241 views

How to protect my network against local flood attacks?

I installed VM centOS 6.8 then I installed hping3 tools. With this tool, I can take down any PC connection on the network as well as increase CPU and RAM usage with the following command hping3 --...
0
votes
0answers
55 views

proprietary encryption to protect communication [duplicate]

Please note, my question is purely theoretical. Let's say I decided to use encryption to protect communication. So I develop a propertiary encryption algorithm for this purpose. Which practical issues ...
0
votes
1answer
110 views

What security threats do tradesmen face in their use of IT?

I'm designing a system for tradesmen and doing research into the security issues. I have the basics covered and am now looking for more specific threats. What threats or vulnerabilities may be ...
6
votes
3answers
3k views

Storing application secrets safely on Linux

I have an linux application that needs to read a secret to decrypt some data. The application also allows the users to change the encryption password during runtime. The application will run under a ...
3
votes
0answers
52 views

Obscuring/detecting changes to a digital photograph

Note: I'm asking this here because it seems to be a better fit for security than for photography, since it deals with data manipulation and forensics. With so much of our modern security based on ...
0
votes
1answer
143 views

Which security features should a switch offer that firewall cannot?

Are there any kind of security functions that typically must be provided by a switch, because these security features cannot be run on a firewall (which typically works on layer 3 = IP layer and above)...
0
votes
1answer
72 views

Can the content of a plain-text help breaking the key to the encyption used? [duplicate]

i am currently trying to encrypt a set of files safely (using AES encryption in CBC mode), but knowing that plain text copies of some of these files may be floating around the file system i am worried ...
0
votes
1answer
594 views

Cuckoo Sandbox - Unable to enable internet access via hostonly & iptables

I'm having some issues with my deployment of the Cuckoo Sandbox. I have been unable to enable internet access for the VM via the hostonlyif, vboxnet0 and IPtables rules. Here are some details ...