Questions tagged [documentation]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
54 views

When referring to key types and lengths, is there a correct order to stating the type and length?

When referring to key types and lengths, is there a correct order to stating the type and length? For example, would I use "2048-bit RSA key" or "RSA 2048-bit key" in documentation?...
Paul's user avatar
  • 131
1 vote
2 answers
94 views

any security baseline reference we can use? paid or free

We are looking to provide our Devs and Ops with minimal security baseline requirements - reference materials that they should follow during coding/implementation/etc. Maybe requirements based on NIST ...
Andrei Clear's user avatar
1 vote
3 answers
997 views

Sharing internal security policies with potential customers?

We have a set of ISMS documents like master security policy, supplier relations etc. classified as INTERNAL according to data classification policy. Now a potential customers infosec department is ...
crackmigg's user avatar
  • 115
0 votes
1 answer
500 views

Kubernetes show secrets for namespace

I stumbled upon this command: kubectl get secrets -n namespace-name (Jay Beale, Attacking and Hardening Kubernetes | KringleCon 2020) It seems to list the secrets for a specific namespace (here ...
secf00tprint's user avatar
4 votes
1 answer
147 views

Need help collating resources for an information/cyber security audit document for an MSP

I am currently serving out an internship with a small MSP (4 employees, 50-100 clients with between a couple and 100 employees). My main project is to work on a information/cyber security audit ...
Vehicular IT's user avatar
1 vote
0 answers
100 views

Addressing security issues for documenting internal systems

The Situation I'm presently a member of a healthcare records team that is sorely understaffed and has an incredibly low bus factor, with only two people with the majority of system knowledge, myself -...
SE Does Not Like Dissent's user avatar
5 votes
3 answers
181 views

How do I diagram a network node with multiple layers of trust?

If I'm communicating security and trust over a network, I might simply note trusted and untrusted nodes. For example, when making an HTTPS connection over some kind proxy node that I own and operate, ...
lofidevops's user avatar
  • 3,620
1 vote
1 answer
2k views

Does the OWASP Zed Attack Proxy project have a list of all the vulnerabilities it tries to find/exploit?

I'm trying to compile a list of vulnerabilities that ZAP tries to find when you run the "Active Scan" in ATTACK mode on a webapp. Does this list exist in the documentation anywhere? If it also has a ...
trallgorm's user avatar
  • 885
3 votes
1 answer
108 views

How should we store and share information about our security protocols and plans?

I'm assuming that it's a good idea to document your security protocols, response plans, and attack surfaces. Of course, if you simply stick all of that information on GitHub (minus your secret of ...
Wayne Werner's user avatar
  • 1,795
3 votes
2 answers
2k views

metasploit exploits and payloads documentation

Where can i found the documentation of the exploits and payloads available in metasploit. I am looking for a documentation that tells what does the exploit or the payload do, and possibly a ...
Sidahmed's user avatar
  • 679
2 votes
1 answer
223 views

Is it necessary to have security documentations, policies, DRP & BCP's at place in order to execute secure network architectural review?

One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables ...
Shritam Bhowmick's user avatar
3 votes
1 answer
230 views

What is "Intentionally misleading Artificial Intelligence to create a misleading outcome" called?

I'm writing about a computer system that relies on Artificial Intelligence and the threats that this may include. One threat vector (for example) is to seed Bayesian AI with content to skew the ...
makerofthings7's user avatar
1 vote
1 answer
280 views

In the United States, when can someone legally search my personal laptop? (Government or private security) [closed]

Unlike the United Kingdom, U.S. citizens don't have an explicit right to privacy in the Constitution. Although there are implied privacy rights within "penumbras" of the Bill of Rights this has ...
makerofthings7's user avatar
2 votes
2 answers
145 views

Are documented networks easier to attack? Are undocumented networks easier to protect?

I am learning about network documentation for the first time and have come across the following statement: Undocumented networks might not be protected and can be used to support insider attacks. ...
Caleb Owusu-Yianoma's user avatar
-1 votes
1 answer
99 views

Should security documentation referencing "state sponsored exploits" be revised to include large corporations also?

Security-related documentation (and casual conversation) often describes threats that require a lot of resources as "state sponsored" Given that large mega-national corporations have more income ...
makerofthings7's user avatar
35 votes
5 answers
4k views

How can I explain "zero knowledge proof" to an end user?

A ZKP allows proof of knowing the answer to a secret, without actually disclosing what that answer is. Is there any analogy that can help people put this concept into everyday practice? A "lie to ...
makerofthings7's user avatar
4 votes
1 answer
2k views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
phiz's user avatar
  • 306
1 vote
2 answers
211 views

Is Wiki software a good idea for Disaster Recovery Plans?

I am tasked with the initial draft of an IT disaster recovery plan for my organization. My predecessor never started one so now I am the lucky fellow to tackle this project. My experience in working ...
I2thesecond's user avatar
5 votes
2 answers
888 views

How should I document my Public Key Infrastructure?

I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert. I suppose the ...
makerofthings7's user avatar