Questions tagged [security-by-design]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
61 views

Who (Designer or User) Should be Resposible for the Correct/Secure Usage of a Tool Intended for Developers/Admins? [closed]

There is a healthy debate around a series of stack overflow posts that refer to the "RunAs" command. Specifically the discussion is in reference to design decision that the folks at ...
0
votes
0answers
25 views

What are the use case to host services on tier 2 firewall?

We have a tier 1 and tier 2 firewall What are the use case to host services on tier 2 firewall? e.g. is connection from field enineers/remote workers one of those? What security risks and controls ...
0
votes
1answer
41 views

Is testing for all executables without considering any files in the system is enough for deducing whether the system is infected with malware?

I came to know that the malicious activities will be carried out only by a software(program) whereas the malicious files(data to the softwares installed in the system) can't perform the malicious ...
1
vote
4answers
119 views

Is it possible to detect malicious software just by analyzing the code structure?

I'm a newbie to software security. I'm designing a network and I was wondering is it possible to detect if a program upgrade being downloaded on the network is malicious just by analyzing the ...
2
votes
3answers
161 views

Are injection vulnerabilities a design or an implementation flaw?

Are injection vulnerabilities mainly a design or an implementation problem? I'm using SQL injection as an example; I'm interested in other injection vulnerabilities as well. I believe that it is the ...
-2
votes
1answer
61 views

I opened an http website from my email, how can I know if it's safe?

So, I have Google alerts set for a few words, and one of these alerts had a link to the site "chatsosedi.ru" which I opened. I found out the site isn't https. I clicked on it before realizing. Is it ...
1
vote
1answer
57 views

How can I preserve the uniqueness of a document without a database?

I’m willing to create a system of transferable documents (identified by it’s ID) whose author can transfer his ownership of that document to another person (identified by his/her ID). For example: ...
1
vote
0answers
95 views

How can you stay safe from spyware used by governments? [closed]

It is a fact that antivirus software can't detect all the spyware/viruses/malware that exist. And when they get detected, new ones are created. An example is the pegasus spyware for ios created by ...
3
votes
1answer
63 views

What are the security implications of allowing API consumer to decide primary key stored in database?

Story We are developing an API that which allow consumer to create or modify (i.e. upsert) objects stored in database via an endpoint with HTTP PUT. The primary key of the object stored in this way ...
0
votes
0answers
36 views

is there a name for security principle of “balance-preserving functions”? (e.g. for bank balances)

Suppose you are designing software to manage bank balances for different accounts belonging to a given customer. A single customer can have multiple accounts with a bank, such as a credit card ...
2
votes
1answer
78 views

Multi Factor and order of authentication [duplicate]

I'm questionning the design and architecture around 2FA/MFA controls while authenticating to services and servers. On major platforms(*), the end-user is: first prompted for credentials (username/...
7
votes
2answers
1k views

End-to-end Encrypted Group Chat Considerations

I was thinking about building a simple end-to-end encrypted chat with group chat capabilities. Please bare in mind that 1) it's just an experiment to help me know more about cryptography and 2) I'm an ...
2
votes
0answers
143 views

Why don't smartphone manufactures write the IMEI onto one time writable ROM so that it can't be tampered with? [closed]

The title says it all basically. Even now, why is tampering IMEI possible at all? Shouldn't manufactures be using one time writable memory to embed IMEI into phones? Why don't they?
0
votes
2answers
86 views

Exception handling in multi-tier applications [closed]

Error and exception handling in web applications can introduce security issues, often in the form of denial of service (i.e., when a service crashes because of poor error handling) and information ...
1
vote
1answer
167 views

Can you tell me if my design is secure?

I'm designing a database interface for a system that could store PII. My first focus is on making sure all the data is secure, to do this I have designed the system as follows. I'm running three ...
1
vote
1answer
107 views

How useful is PDF signing in real world usage?

Background senario: So we had a problem where our system (Alice's shiny widgets) generated a PDF with a quote amount for 10 widgets. Someone (Eve) took the PDF, altered it to increase the price by 20%,...
2
votes
3answers
300 views

Partitioning database to enhance security/anonymity?

The goal here is to prevent identification of the users and their data. Is it a good idea to partition my database into multiple ones, one for each kind of sensitive data, hiding the links between ...
1
vote
1answer
1k views

Can the person who buys my old number access my old Viber contacts?

I was using Viber on my old phone. I stopped using that SIM card/number and stopped using that phone. I forgot to deactivate my Viber account. When my old SIM card carrier sells my old number to a new ...
-1
votes
3answers
724 views

How do headphones work? Do they contain firmware? [closed]

How do headphones work? Do they contain any firmware or any instruction set? Are they vulnerable to anything? Good old wired analog Jack ones, not USB wired, wireless, Bluetooth which have lot of ...
0
votes
2answers
114 views

limiting automated domain creation by malware

As we know most of the malwares create thousands of domains and subdomains using DBA for setting C&C communications. The domain names are controlled by Internet Corporation for Assigned Names and ...
0
votes
2answers
395 views

Design and Security Architecture - where should IPS/IDS be placed?

I am a system architecture working on projects - mostly CDN related projects - and I am currently a bit confused about where the IPS/IDS should be placed. We have a NGINX-based webserver for the edge ...
0
votes
1answer
85 views

Media content protection [closed]

I have been trying to encrypt media(Video and audio content) from a nodejs server to a client like android or iOS. I heard of DRM but could not get a reliable implementation of DRM. I wanted to make ...
9
votes
2answers
1k views

Security by design - clarification

I work as a contractor in the IS Security field. I was hired by my current client to design and enforce a methodology to make sure security risks are assessed and addressed in all IT projects. Besides ...
1
vote
1answer
111 views

How to convince someone to use layered security?

Layered security, also known as layered defense, describes the practice of combining multiple mitigating security controls to protect resources and data. How to convince someone to use layered ...
2
votes
2answers
135 views

Why isn't applying security and usability best practices enough?

I have a homework question that suggests that applying security and usability best practices isn't enough to create a secure and usable system. What am I missing? Why isn't this enough? If I follow ...
3
votes
1answer
137 views

Security-by-design based on an existing framework or a custom design?

Personally I do most of the development in PHP (the programming language doesn't really matter for this question). Popular PHP frameworks along developers are for example: CodeIgniter Laravel Symfony ...