Questions tagged [defense]

Defense is the use of security countermeasures to protect the integrity of the information assets in an IT system and/or infrastructure.

Filter by
Sorted by
Tagged with
0
votes
2answers
115 views

Is restricting access to file content a way of securing sensible but day to day needed information from 3rd party software?

To clarify this directly. I mean what if every (even malicious) 3rd party software running on this OS gets never access to its data and rather 'describes' what to do with? So for example 'here at ...
12
votes
2answers
4k views

Is there a test for KRACK (devices and routers)?

After Heartbleed was announced, a number of tests popped up that let me test if a server I was connecting to was patched, unpatched or unknown. For example, https://filippo.io/Heartbleed/ Is such a ...
-1
votes
1answer
89 views

Why aren't more wifi points compromised? [closed]

Especially in light of the recent KRACK problem. Wifi has been compromised before; and undoubtedly it will again. So I have to wonder, why don't criminal organizations travel around major cities, ...
1
vote
6answers
328 views

What is the best way to defend against an already comprised computer with a keylogger that is active?

I'm curious to what are the possible solutions to defending against a comprised computer with a key logger installed. Assume you had to login to a site with a user / password and there's no way to ...
4
votes
2answers
64 views

Is There an Analogous Agency to OSHA but for Bad Data/Security Practices?

I ran into an old coworker and we were both discussing some of the bad practices our old workplace(that dealt with very sensitive data) had and looking back some of them are really bad and probably ...
0
votes
1answer
75 views

Best practices with respect to hard drive reconstruction

I would like to be able to store encrypted information on my computer, that no one else is able to read without the right password, even if they have complete access to the computer. There are of ...
1
vote
1answer
498 views

IAT Hooking questions?

I have researched IAT hooking by malware and i still have a few questions: If the IAT of the program in memory is different to the IAT of the static program (before it has been ran) does this imply a ...
19
votes
4answers
3k views

What lessons can be learned from the latest spate of Ransomware attacks? [closed]

I'm not sure this is the right place, but figured people would find it useful if they aren't too familiar with security policies and general best practices. There is a lot of information out there, ...
2
votes
1answer
991 views

SIEM Alien Vault recommended method for muting noise

I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that ...
0
votes
1answer
84 views

How to enforce software updates on workstations?

There are many workstations on the company network with various kind of software installed: web browsers, OpenVPN clients, remote management agents, encryption utilities and other tools. Some of the ...
0
votes
2answers
3k views

How to detect if someone is using airmon-ng [Aircrack-ng] in my wi-fi network

Using the Linux Kali distribution, I was able to get the password from my wifi network using the airmon-ng [Aircrack-ng] tool. However, how can I find out if someone is doing this on my network?
2
votes
1answer
130 views

Ads on Checkout a Bad Idea™?

Is it a categorically bad practice to run third-party aggregated ads on a checkout page where sensitive information is entered? This sends of all kinds of alarm bells for me, but I've had a ...
1
vote
1answer
68 views

Best practice / Risk Assessment payment websites

I have two websites which do both accept payments on a subdomain. The subdomain is an independent system from the main website. I have a question regarding the best practice to decide which of the ...
1
vote
1answer
102 views

How to use encrypted internal strings and config? [duplicate]

I was reading the CIA leaked documents on wikileaks, I saw in their "best practices" section that it was advised to encrypt all strings and config information and to de-crypt in memory when needed. ...
0
votes
1answer
109 views

Network Defense- White listing IPs/Ports

If I had a typical home user machine (google, email, youtube, no ssh/ftp, etc...) that had a dynamic iptables white-list that was dynamically updated with IP addresses that have been legitimately been ...
8
votes
5answers
356 views

Could ransomware be stalled while encrypting?

I have been reading about ransomware, and I was wondering if it could be defended against by having certain "trap" files on a drive. Sometimes I look through Code Golf and am thoroughly impressed by ...
1
vote
1answer
111 views

How to convince someone to use layered security?

Layered security, also known as layered defense, describes the practice of combining multiple mitigating security controls to protect resources and data. How to convince someone to use layered ...
1
vote
2answers
483 views

Relay attack against Captcha

I am implementing a website that included my own text Captcha (I do not use any Captcha service - like reCaptcha). the Captcha code serves each challenge (i.e. image) only once for both display and ...
2
votes
1answer
587 views

Potential HTTP Host header attack from malicious IP, what does it mean in practical terms for me? Should I be concerned?

I'm asking about an error I've got a few times in the past day, outside of the theoretical. I'm wondering what may be actually happening in my case. The error comes from Sentry, on my ubuntu/nginx/...
0
votes
1answer
199 views

Locking down Ubuntu

A competition is coming up at my school for securing computers and my OS for this challenge is Ubuntu. I'm trying to think of things to add to my list of security measures and things to look out for. ...
1
vote
3answers
89 views

“Green is good” and related security advice

From Citizen's bank login page: Should my browser address bar have a "green" indicator when I use Online Banking? Yes. As an added measure, Online Banking gives you the capability to easily ...
1
vote
1answer
1k views

How to validate CSRFGuard token on the server side?

I have implemented the OWASP CSRFGuard library to protect my application against CSRF attacks. I'm using the CSRFGuard JavaScript file and servlet to inject CSRF tokens in all the Ajax requests. So ...
1
vote
3answers
337 views

How to protect my network against local flood attacks?

I installed VM centOS 6.8 then I installed hping3 tools. With this tool, I can take down any PC connection on the network as well as increase CPU and RAM usage with the following command hping3 --...
0
votes
1answer
112 views

What security threats do tradesmen face in their use of IT?

I'm designing a system for tradesmen and doing research into the security issues. I have the basics covered and am now looking for more specific threats. What threats or vulnerabilities may be ...
10
votes
3answers
10k views

Storing application secrets safely on Linux

I have an linux application that needs to read a secret to decrypt some data. The application also allows the users to change the encryption password during runtime. The application will run under a ...
3
votes
0answers
57 views

Obscuring/detecting changes to a digital photograph

Note: I'm asking this here because it seems to be a better fit for security than for photography, since it deals with data manipulation and forensics. With so much of our modern security based on ...
0
votes
1answer
148 views

Which security features should a switch offer that firewall cannot?

Are there any kind of security functions that typically must be provided by a switch, because these security features cannot be run on a firewall (which typically works on layer 3 = IP layer and above)...
0
votes
1answer
83 views

Can the content of a plain-text help breaking the key to the encryption used? [duplicate]

i am currently trying to encrypt a set of files safely (using AES encryption in CBC mode), but knowing that plain text copies of some of these files may be floating around the file system i am worried ...
0
votes
1answer
937 views

Cuckoo Sandbox - Unable to enable internet access via hostonly & iptables

I'm having some issues with my deployment of the Cuckoo Sandbox. I have been unable to enable internet access for the VM via the hostonlyif, vboxnet0 and IPtables rules. Here are some details ...
2
votes
3answers
382 views

Admin Functionality visible to basic users

An application's interface is same for every type of user role. The access-matrix is also well maintained. However, the names of almost all functionalities are visible to all the users. But if the ...
10
votes
2answers
1k views

Does insert only db access offer any additional security

There are concerns that if our public facing web nodes are compromised, an attacker will gain access to all our data. It just so happens that data entered from outside users only needs to be ever ...
3
votes
2answers
194 views

Are there established and/or curated security benchmarks/best practices for home appliances and networks?

I have seen several security standards and best practices for organizations (CIS, HIPPAA, PCI DSS) but are there any for homes? If yes, where can I find them? It would be nice for homeowners to have ...
1
vote
1answer
76 views

Protecting vs Defending a system

What is the difference between saying defending a system from attacks or protecting a system from attacks? This question might be trivial to most of you but I really don't see the fine line here. In ...
172
votes
26answers
22k views

Convince people not to share their password with trusted others

IT workers are usually trusted by their family members who readily share passwords (Facebook, email, twitter, you-name-it!) so they can get easy help to set what-ever-parameter they don't find or ...
0
votes
1answer
297 views

So where do I start learning about Cyber Sec? [duplicate]

I'm an 11th grader interested in the whole field/world of IS and what not so I decided to look around this site and various others, and I have come to the conclusion that I have no clue where I am to ...
1
vote
2answers
1k views

What skills will I need to learn for a 'Security Analyst' job role? [closed]

What skills will I need to learn for a 'Security Analyst' job role? By this, I mean someone who monitors the network to uncover compromised systems. I believe this is similar to working in a Blue ...
2
votes
1answer
76 views

Developing Small Business Information Security Standards

I'm looking for some resources and hoping some of you security experts can help. Quick Background: I recently started my first job out of college working at a small organization as a Web Developer. ...
1
vote
3answers
5k views

Encrypting the API response in a single page app

I am building a single-page(React-Redux on FE, Rails-API BE) application which makes a bunch of REST API calls to get certain information for logged-in users. Some subset of that information (...
1
vote
0answers
49 views

Making sure to type in the right password on the right place

This is not about technology, but about human factors. I type in passwords so often, that it is a habit that doesn't require thinking. I type these fast and correct. Lets take an SSH agent password ...
2
votes
3answers
144 views

Why are encryption methods chosen by what is not broken instead of what is possible?

I've noticed there's an absurd amount of time, effort and arguments about whether or not we should use certain crypto ciphers or encryption methods. In this link some people go into how certain ...
4
votes
1answer
471 views

What is the best practice for giving Oracle DB credentials to a Java Application?

I have Java applications (using Spring running in Jetty Servlet containers) that need to access an Oracle database. What is the best practice for giving the DB credentials to the applications? I came ...
4
votes
1answer
585 views

Exploitation of missing is_uploaded_file check?

The PHP documentation for is_uploaded_file says: Returns TRUE if the file named by filename was uploaded via HTTP POST. This is useful to help ensure that a malicious user hasn't tried to trick ...
0
votes
1answer
87 views

What are some ways that an attacker could use a 301 or 404 http response?

So I know that there is not a definitive answer for this question, but I am curious to see what others might know about this subject. The company I work for sees a lot of external network sweeps, and ...
7
votes
4answers
478 views

Simple defense against power analysis?

I would like to hear your opinions and how effective would my proposed defense is against power analysis. It is one of the nastiest side channel attacks because it's undetectable and passive, but ...
3
votes
2answers
361 views

Good Practice to Secure Computer Terminal?

I am currently trying to set up a computer terminal from scratch at home. The use of it is basically as a terminal to connect to cloud servers hosted remotely in the internet. I am trying my best to ...
4
votes
1answer
98 views

Is filtering flash based on the mimetype enough to keep it out?

As flash is a real security mess I started blacklisting flash at our proxy by blocking any content with the mime type application/x-shockwave-flash which works pretty well as far as I can tell. The ...
21
votes
6answers
23k views

Would removing spaces in a string protect against SQL injection?

I was curious if it's possible to protect against an SQL injection attack by removing all spaces from an String input? I have been reading up on SQL Injection at OWASP, but they don't mention anything ...
4
votes
3answers
3k views

Is it acceptable for customer service to ask for my PIN?

I tried to initiate an online chat with customer service of a company I am trying to do business with this weekend, but before they would answer any of my questions they requested that I give them the ...
20
votes
2answers
4k views

What are the negative aspects of creating fake security footprints?

My take on reducing the risk of being hacked on products and installation have often been to create false footprints. From my own experience, the servers I've spent most time (and hate) on hacking ...
5
votes
1answer
894 views

How does reuse attack protection (RAP) work?

The grsecurity folks just released a test patch for the 4.5 Linux kernel which includes Return Address Reuse Attack Protection or RAP, a protection technique against return-oriented programming (ROP). ...