Questions tagged [defense]

Defense is the use of security countermeasures to protect the integrity of the information assets in an IT system and/or infrastructure.

Filter by
Sorted by
Tagged with
0 votes
0 answers
63 views

How to properly protect company laptop on a business trip to China [duplicate]

This question (How safe are employee laptops in China against International corporate espionage?) got me thinking - what is the proper way to go on a business trip to China and protect your laptop. ...
rgedn's user avatar
  • 151
1 vote
1 answer
90 views

Sharing the key to a password vault securely

We have an application that holds a bunch of passwords in an encrypted vault for various purposes. What is the best practice for storing the key for that vault? There feels like there's a ...
Hovestar's user avatar
  • 113
0 votes
1 answer
100 views

Does self-signed encryption certificate violate "no multi-use keys" principle?

Say that I have generated an RSA keypair, which I intend to publish only for use with RSA-KEM; I can see that this is provisioned for: The intended application for the key MAY be indicated in the key ...
JamesTheAwesomeDude's user avatar
0 votes
1 answer
453 views

What are the best practices to safely store OAuth2 tokens in a database?

I'm building a website with Patreon integration and I have identified the need to store Patreon user's OAuth2 token in the database. I'm wondering what's the best way to do that, security-wise. Some ...
Vilx-'s user avatar
  • 1,030
0 votes
1 answer
92 views

OS/DB Hardening Checklist Drafting Process

We are looking into reviewing our organization OS/DB hardening checklist (done by predecessor). We're aware that there are various benchmarks out there like CIS & STIG to guide on that, and the ...
nlks's user avatar
  • 3
0 votes
3 answers
140 views

Security in depth vs security theatre

If some security measure serves only to add an extremely small barrier to an attack, are there generally accepted principles for deciding whether that measure should be retained? Does defence in depth ...
benjimin's user avatar
  • 155
0 votes
2 answers
179 views

How do you detect attacks on Intel ME firmware and the AMD equivalent?

Since there are quite a few exploits of Intel ME firmware in the CPU (same applies to AMD), I would like to know what SIEM solutions are there for detecting these kinds of attacks. To be more exact, I ...
Sir Muffington's user avatar
1 vote
1 answer
483 views

Is it still recommended to block Living Off The Land Binaries (LOLBins) in Firewall?

https://lolbas-project.github.io/ Realistically, do we still need to block cmd.exe or certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only ...
user avatar
1 vote
1 answer
97 views

Reuse credentials if same data in same security environment

We're managing a shared hosting environment of Wordpress websites on a web server. Each site has its own database password and FTP password, both are randomly generated and stored in AWS ...
jdog's user avatar
  • 345
14 votes
6 answers
5k views

Is it acceptable to exclude folders in antivirus?

A technical problem has arisen, and the vendor's first suggested solution is to exclude the program's folders from our antivirus. There are multiple reasons I am hesitant to do so: Primarily: If a ...
Seymour Guado's user avatar
2 votes
0 answers
68 views

Normative reference for a web application disclosing existing values of integration secrets to users

In a web-based SaaS product, one of the configuration pages allows users to set credentials for system-wide integrations with other products. These include usernames, passwords, and API secrets. The ...
rmc47's user avatar
  • 121
0 votes
2 answers
169 views

Is not Electrum's Seed Word Autocomplete a Theoretical Security Risk?

As the image below shows, when you try to restore an existing wallet from a seed (a sequence of 12 words), the program offers some autocomplete suggestions. Though I'm sure the risk is purely ...
user avatar
0 votes
0 answers
99 views

Are there any security architecture patterns in the same way there are software design patterns (GOF)?

So I've been googling around and couldn't find an answer to my question (I don't discount the option that I could be asking the wrong question after all). I see there is a question that deals with ...
4d4143's user avatar
  • 133
1 vote
1 answer
172 views

Is "time locking" a good strategy for protecting data with HSMs?

I've read several times that many HSMs support configurable rate limiting on cryptographic operations, as a way of protecting against a hacker that compromises a server that has access to the HSM. So ...
bnsmith's user avatar
  • 87
2 votes
1 answer
234 views

How to prevent small mistakes that have massive impact?

I frequently have very personal files temporarily on my virtual desktop. I sometimes download a new program, which is going into a VM. Before sending it in there, I tend to VirusTotal scan it. I load ...
M. Moyna's user avatar
1 vote
2 answers
228 views

Can some HSMs send requests to other servers before performing an encryption/decryption operation?

In various discussions of Security Architecture, I have read that HSMs can be configured with rate limiting on the number of encryptions/decryptions that can be performed in a given amount of time. If ...
bnsmith's user avatar
  • 87
0 votes
1 answer
365 views

Using an HSM to protect encrypted data even when a server is compromised

Imagine a system architecture where an API server is able to send a request to an HSM, and the HSM is able to decrypt some data for a particular user/customer, in order to serve some hypothetical ...
bnsmith's user avatar
  • 87
0 votes
0 answers
121 views

What OS do I focus on when learning Cyber Defense?

After some time in the Cyber Defense field, I am noticing that there are different learning paths to take depending on the OS you choose (for example you can learn how to use PowerShelll and lots of ...
Néstor Llop's user avatar
1 vote
3 answers
1k views

Why is it not recommended to permanently use the root account for all tasks?

Yes, I did read this answer: https://apple.stackexchange.com/questions/192365/is-it-ok-to-use-the-root-user-as-a-normal-user/192422#192422 But I still fail to understand the reasoning behind this ...
gaazkam's user avatar
  • 6,015
1 vote
0 answers
112 views

How can I best obfuscate surveillance against my browser? [duplicate]

I mostly use the Tails browser, but I also use Firefox in Fedora with several add-ons such as TrackMeNot, HTTPS Everywhere, uBlock Origin, NoScript, and Fingerprint Detector. I would like to obfuscate ...
Patriot's user avatar
  • 297
1 vote
0 answers
158 views

What can I do to get Google, Facebook, Microsoft, and Twitter out of my Life as Much as Possible? [closed]

Now that those four are in the censorship business and cooperate to surveil and exclude, I want to do more to get them out of my life. No Facebook, no Twitter, no YouTube, no G-mail, no Microsoft, no ...
Patriot's user avatar
  • 297
0 votes
1 answer
297 views

How does one detect and deter golden SAML attacks?

How does one defend, detect and deter golden SAML attacks?
Nathan Aw's user avatar
0 votes
0 answers
26 views

Does "Security By Obfuscation" have any place in good security practices? [duplicate]

One thing I've had hammered into me by pretty much every security expert I've talked to is that security by obfuscation is not a substitute for actual security measures. However, it has me wondering; ...
Bitsplease's user avatar
0 votes
2 answers
274 views

Prevent users from easily changing the backend API URL of a desktop application

Is it considered a good security practice to prevent users from easily changing the backend URL of a desktop application that connects to a backend server with an SSL protected HTTP API? One concern ...
mrucci's user avatar
  • 121
0 votes
1 answer
169 views

Internal HTTPS recommended security practices

So I'm by no means a security expert. I'm just a recently graduated software developer who is working on a contract project and I want to ensure I'm taking appropriate security measures for my client. ...
Jack's user avatar
  • 101
1 vote
1 answer
185 views

Directories enumeration by errors. CVSS3.1 and remediation

Let's consider this scenario. If I browse to https://www.example.com/existentdirectory the web application shows this error "directory listing is denied". If I browse to https://www.example....
Maicake's user avatar
  • 567
1 vote
0 answers
106 views

Security Team and Security in a small-medium organization/startup [closed]

How should one structure and how should a Security Team work in an agile organization (100 devs). Found this article: https://kislayverma.com/organizations/independence-autonomy-and-too-many-small-...
dev's user avatar
  • 997
-3 votes
1 answer
1k views

How am I supposed to check Defender's capability when it trusts me blindly after I mark a test malware file as "allowed"?

With enormous amounts of fighting with Windows/Microsoft Defender, I finally managed to download the "test virus" file from https://www.ikarussecurity.com/en/private-customers/download-test-...
K. Hodgens's user avatar
0 votes
1 answer
205 views

How to guarantee only my client application can request a nonce?

I have a web site and a service in a server. I'm developing the "Register User" and "Login" components. I've searched on the internet and I've found two protocols to login user ...
rmmariano's user avatar
  • 103
1 vote
2 answers
983 views

What is the best way to mitigate malicious bot traffic on a Node Express server?

My public website is getting a lot of get requests to endpoints like "wp-login.php", ".env", ".git/HEAD" and many others. This seems to be a non-trivial portion of my website's traffic and I'd like to ...
Glen Pierce's user avatar
0 votes
1 answer
677 views

How to store encrypted notes in a public git repository?

I save my notes in a git repository in plaintext (markdown). Currently, the remote repository is another computer in my appartment. I am thinking about moving this remote repository to a remote server....
uuu's user avatar
  • 385
1 vote
0 answers
153 views

Whether ISPs provide path of Spoofed SYN Flood attack is the only way to trace the attack source?

The attacker spoofs SYN packets to attack a server. In this document: Spoofed Attack: A malicious user can also spoof the IP address on each SYN packet they send in order to inhibit mitigation ...
244boy's user avatar
  • 925
0 votes
1 answer
447 views

Is my Java code still vulnerable to SQL injection? [duplicate]

We have a Java web application that was vulnerable to blind SQL injection attacks. Our developers fixed the code by using the replaceAll() function to convert single quotes to two single quotes. I am ...
b.k's user avatar
  • 3
3 votes
3 answers
398 views

Why is a fully-patched OS less important than AV?

How to explain to traditional people why they should upgrade their old Windows XP device? <- The interesting point made in the highest upvoted answer to this Q is that a fully patched OS is largely ...
gaazkam's user avatar
  • 6,015
1 vote
0 answers
40 views

Name of security measure that shows user a personal word / phrase / drawing [duplicate]

I remember a security measure I've seen on a few sites in the past against phishing, but I don't know what it's called. When the user logs in, or just inputs their username, the site shows some kind ...
Ram Rachum's user avatar
  • 2,058
3 votes
1 answer
491 views

How to detect backdoor/root shells?

Let's assume I'm a user with root access to a machine and I'm a legit user. My machine/server runs Linux. I'm not very familiar with defensive security (I mainly practice offensive). Sometimes, ...
ChocolateOverflow's user avatar
3 votes
1 answer
294 views

What do I do if I catch someone doing a physical pentest? [duplicate]

This question was primarily inspired by this (related) question, but is about the other side of the equation. I'm a security engineer at Medium Sized Company, Inc. We recently hired John for a ...
Kaz Wolfe's user avatar
  • 382
2 votes
2 answers
1k views

How often, if at all, should I rotate my passwords?

In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
user avatar
102 votes
19 answers
16k views

How to explain to traditional people why they should upgrade their old Windows XP device?

This is an issue I'm recurringly facing: older people from my family (or people who my family members know) can be surprisingly reluctant to apply most basic security measures when they're using their ...
gaazkam's user avatar
  • 6,015
3 votes
1 answer
585 views

How secure is connecting to the Internet via Windows XP (or even older) nowadays only for e-mail?

While trying (and failing) to convice a certain older person who wanted me to "fix" their ~20 years old PC that they should not be connecting to the Internet with whatever version of Windows they have ...
gaazkam's user avatar
  • 6,015
3 votes
2 answers
472 views

How do attacks on web browsers succeed? [closed]

We all know that attacks on web browsers are entirely possible. This includes attacks such as drive-by downloads, MITB (man-in-the-browser) attacks and keylogger browser plugins/extensions. However, ...
rshah's user avatar
  • 153
1 vote
2 answers
1k views

Most secure algorithms for KDF and Public Key Encryption [duplicate]

I'm developing an application which will need to derive a private/public key pair from a user provided password, and then use the public key to encrypt some text (up to 1000 characters in length) such ...
vikarjramun's user avatar
1 vote
0 answers
104 views

OS and Password Manager - How to Manage Multiple Credentials

This question is about best practices, and not necessarily my how I manage my current setup. I have these two scenarios, macOS Mojave with KeepassXC, and Windows 7 + Android 8.0.0 with SafeInCloud. ...
TeckFudge's user avatar
3 votes
3 answers
334 views

Ensuring all network services on a device use strong TLS cipher suites

(This is hypothetical, but based on a real-life problem I've had) Context: I am developing an (embedded) device which includes a few exposed network services. I'm responsible for security, not ...
Josiah's user avatar
  • 241
1 vote
1 answer
4k views

How to block or stop redirection with window.location?

I need to block redirection using window.location on my site. Some hacker has injected a stored XSS script into my site: if(my_username != 'Name') window.location = 'https://the url'; Now each ...
user avatar
0 votes
1 answer
585 views

Preventing host discovery in network

With tools such as Fing (Android app) and netdiscover (Kali Linux tool) its possible to get all connected devices in network. How it's possible to prevent host discovery in a network?
Mario's user avatar
  • 23
-2 votes
1 answer
301 views

How to protect my site from XSS

I own a chat site {https://trixac.com}. It uses BoomChat's code. Recently I banned a troll and now he is back and hes running XSS injections against my site and it's working for some odd reason. I've ...
user avatar
2 votes
2 answers
872 views

If I turn off Windows Defender Credential Manager off in Windows 10 so I can run a virtual machine in Virtual Box, is that a bad idea?

My processor is supposed to support virtualization: cpu.inf:5f63e534115a322c:IntelPPM_Inst.NT:10.0.17134.765:ACPI\GenuineIntel_-_Intel64 ACPI\GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_37_-_INTEL(R)_CORE(...
leeand00's user avatar
  • 1,421
6 votes
2 answers
380 views

Suppose antivirus provider turned malicious: What do we do?

It was recently reported that the hacking group Fxmsp "...claimed to have secured access to three leading antivirus companies," and that they "...extracted sensitive source code from antivirus ...
I say Reinstate Monica's user avatar
6 votes
2 answers
3k views

CSRF token unique per user session - Why?

OWASP recommends that a CSRF token should be unique per user session. What is the attack vector or reasoning behind that? How could an attacker exploit a web application that does not invalidate the ...
Martin Fürholz's user avatar

1
2 3 4 5 6