Questions tagged [defense]

Defense is the use of security countermeasures to protect the integrity of the information assets in an IT system and/or infrastructure.

Filter by
Sorted by
Tagged with
1
vote
2answers
15k views

Trying to get rid of hackers who have access to all my devices [closed]

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
5
votes
2answers
2k views

How do I check if a script is safe to run?

I've been using NoScript for a couple of years now but I can't seem to figure out which scripts are safe to allow and most of the time I just temporarily allow all the scripts. Is there a way to check ...
6
votes
2answers
652 views

Where can I “hide” easter eggs for students learning about Linux security?

I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
-3
votes
2answers
2k views

Time it takes to crack a password on site like yahoo [closed]

I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is ...
1
vote
0answers
93 views

Transaction without 3DS in some online websites is Fraud prone? [duplicate]

I use my MasterCard credit card for online transactions which uses SecureCode for preventing online frauds even though hackers knows our credit card details. I have come across many sites which is ...
2
votes
3answers
177 views

Example of application that doesn't require “strong authentication”

Does anyone have any examples of real-life applications that doesn't require "strong authentication". I am looking specifically for blog posts or even scientific papers that argue that "strong ...
-6
votes
1answer
193 views

Is www.cheap-lingerine.com safe to use my credit card on? [closed]

I want to make sure my information is safe. This website is openly china-oriented but says to secure card information with Secure Sockets Layer technology (SSL) on those pages that involve sensitive ...
1
vote
2answers
121 views

secure flash update

The default method for updating flash is through Adobe's unsecured http portal, which seems to be a serious security concern, given the access that flash has on a user's machine. Can anyone recommend ...
0
votes
0answers
266 views

Asking for more information about AlienVault.com using Spiceworks, viability of “suspicious IP” alert

Website here: alienvault.com I've been trying out Spiceworks for about a week, seeing what use I get out of it. Today I log in and see an alert: "(my computer) has established a connection to ...
2
votes
1answer
574 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
3
votes
1answer
1k views

Do non-browser clients work around Gmail's 2-factor authentication?

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the ...
0
votes
2answers
3k views

How to post comments on websites without being traced back

Just trying to get some general sense about the security on internet now-a-days. There are so many websites I go and comment on different things. If some comments are political and they don't like, I ...
2
votes
1answer
1k views

How ATM Surveillance Camera works? [closed]

I would like to know how the ATM pin hole camera works.Whether the pin hole camera works only once the card is inserted in ATM or during the cash withdrawal or it works always?
24
votes
5answers
4k views

Should I let a user know they have entered an unknown username or email address?

On my website I have a password reset page that users can use if they have forgotten their password. On this page they can enter their username or their email address and hit "reset" which will send ...
0
votes
1answer
955 views

Preparation for Blue Team Competitions [closed]

I am a CS student, and am considering competing in the National Collegiate Cyber Defense Competition. Although I have a fair amount of experience in programming competitions (e.g. ACM at High School ...
0
votes
1answer
195 views

What should you do when you notice weird traffic?

I'm not at this point yet, thankfully, but being prepared means knowing the answer before the issue arises, so here goes... You're looking through your firewall / website logs... And you notice a ...
1
vote
0answers
158 views

Industry average for security as a percentage of product budget?

Lets assume the product is pure software or a blend of software and cheap commodity hardware. Is there any work showing what the average industry spending is on just the security aspects as a ...
-3
votes
2answers
235 views

How to respond to Cyber Bullying? [closed]

I am trying to learn about Cyber Bullying and I was thinking that if in future I get bullied, then what I can do? I have learned how to use Maltego, but if someone damages your reputation, then is ...
3
votes
2answers
153 views

Difference between secure design patterns and a generic coding guidline?

Is there a difference between secure design patterns and a generic coding guideline from which you can derive a technology specific coding guidline? Patterns like "authentication", "secure sessions" ...
-2
votes
2answers
1k views

Life in cybersecurity: How do I get there? [closed]

I am 17 years old and my ultimate job goal is a cyber security professional. I have been extensively studying TCP/IP, along with all other subjects in the CompTIA Network+ certification which I hope ...
1
vote
1answer
73 views

Is a government entity capable of establishing a secure virtual currency system? [closed]

After reading about BitCoins, I can't help but contemplate the idea of the a government withdrawing paper money and bringing all currency transactions digital, via a bitcoin-like method where every ...
0
votes
2answers
1k views

Programming languages for security? [duplicate]

I am a computer science student interested in the field of security and just had a few questions. What are the pros and cons for using C# for security purposes, I had assumed applications programmed ...
0
votes
1answer
107 views

Do software systems become more secure every year? [closed]

It seems to me that computer software is becoming more secure every year - there are fewer zero-day exploits to be found, many hacker-proof concepts are becoming widespread (such as virtualization and ...
4
votes
2answers
4k views

Nowadays, what is the difference between Cyber Security and IT Security?

Lately (and not so lately), you can hear a lot about cyber security. It is really hard to find an official description about this matter so, let's take the ISO 27032 description: "Cybersecurity” ...
0
votes
1answer
220 views

Which is considered the first Cyber Security incident? [closed]

No matter we are talking about Information Security, or cyber security or IT security... I always hear first about "the moth" being the first security threat. But I don't believe it is when talking ...
3
votes
1answer
241 views

Similar products to MS EMET [closed]

Following the weekend announcement from Microsoft regarding the vulnerability in IE I have been looking at additional security defences for our endpoints. I've read some technical documentation and ...
0
votes
1answer
102 views

A demonstration of the most basic form of a data breach or similar attack

I am currently working on my bachelor thesis regarding cloud security and found this neat article describing the "Notorious nine" written by the CSA: The notoruios nine I am looking to try out some ...
3
votes
3answers
299 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
7
votes
3answers
274 views

Server Infection: post-cleanup best practices

I've read through How do I deal with a compromised server? and have followed the steps to cleaning-up/mitigating any future damage. I'm just wondering if there are any post-clean up steps that are ...
1
vote
2answers
274 views

How to know what personal information companies know about myself

I've been learning about Cyber Security and how to protect myself online after reading some books on the subject and I want to know how much Information i've handed out to companies.
2
votes
1answer
225 views

Method/program for editing secure files

I'm not entirely sure if this is on-topic for Security.SE, but it doesn't seem entirely off-topic either, so I'll try. :) I keep a couple of (GPG-)encrypted files with more-or-less sensitive ...
-2
votes
1answer
5k views

A clear definition for procedural security controls? [closed]

Can you please provide a clear definition for procedural security controls? Are operational and procedural security controls synonyms? Thanks
2
votes
3answers
694 views

What is the current best practice to secure an executive's laptop?

What is the current best practice to secure an executive's laptop? The exec will be processing highly sensitive documents (high-value bids, merger & acquisition info, technical specs). As such ...
16
votes
4answers
2k views

Why should XSS filters escape forward slash?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' --...
3
votes
1answer
827 views

Localhost WebSocket defense

If a malicious application has found its way onto a computer running a localhost only WebSocket server, would it help if the communications used SSL? If so, how could SSL fail if a malicious app ...
13
votes
2answers
9k views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
2
votes
2answers
184 views

Ideal cryptocurrency digital signature

What are the characteristics of the ideal digital signature for cryptocurrency transaction verification? The reason I ask is because this answer about bitcoin signatures describes a potential ...
2
votes
1answer
500 views

List of social engineering hacks and defenses [closed]

Sorry if this question is absolutely stupid or irrelevant, but I can't help but ask. I am just curious about different approaches hackers take in social engineering attacks, and clever examples of ...
-4
votes
2answers
2k views

Defend against HTTP fingerprinting

I'm looking for ways to defend against common fingerprinting techniques used by hackers to identify what kind of setup my website is running on. I understand this is a complicated topic, and every ...
1
vote
1answer
3k views

Why Qualys SSL Server Test is giving me 80 and not 100 in Key Exchange?

My openssl ciphers -v 'CIPHER' output is the following: ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=...
3
votes
2answers
348 views

Is it true, that using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret?

I am a newbie in the security field, so sorry for the naive question. In my understanding, using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can ...
8
votes
2answers
3k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
14
votes
4answers
2k views

How effective are anti-virus products against real-world threats?

In a recent interview† with Dave Kennedy, he in passing pegged the average effectiveness of anti-virus products as detecting approximately 3% to 5% of current active threats. While AV comparisons ...
5
votes
4answers
8k views

Is it better to choose a single vendor or multiple vendors

A discussion came up at work recently and a debate ensued regarding choosing a vendor. Several people were of the opinion that it is smarter and easier to choose a single security vendor for all our ...
6
votes
1answer
237 views

CSRF protection - 'back pages'

OWASP suggests that when implementing CSRF protection any attempt to go 'Back' in the browser will cause issues as Interaction with this previous page will result in a CSRF false positive security ...
10
votes
2answers
5k views

When, exactly, should old password reset tokens be deleted?

I'm trying to figure out best practices for working with password reset tokens. Say a user initiates the password reset process and the are emailed the reset token and we store a hashed copy in the ...
4
votes
4answers
6k views

Database hardening techniques

So as I understand it database hardening is a process in which you remove the vulnerabilities that result from lax con-figuration options. This can sometimes compensate for exploitable vendor bugs. ...
7
votes
2answers
322 views

Are temporary blocks sufficient response to network probes?

We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time. ...
2
votes
2answers
178 views

Which hard disk encryptions schemes are tied to the original hardware?

When using a laptop, an encrypted HD/SSD can be an important security measure. However, laptops are prone to accidents (fluid spills, dropping on the floor, etc) that may mandate some or all of the ...
6
votes
1answer
1k views

Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?

This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's ...