Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [standards]

The tag has no usage guidance.

0
votes
1answer
26 views

Is there a technical security standard for internet facing test environments?

We have a number of test environments that are permanently internet facing to accommodate external and automated testers with dynamic IP addresses. While we regularly check the servers for security ...
0
votes
0answers
12 views

OIDC Protocol :: Different OIDC Server End points

OIDC Specifications: Authorization Code Grant Flow. As OIDC Server is shall list the various end points (Auth EP, Token EP, Token validation EP etc.) In this scenario, Can Auth End Point and Token End ...
2
votes
2answers
113 views

Is Blowfish validated against any standards?

OWASP ASVS 3.0 V7.7 states the following: Verify that cryptographic algorithms used by the application have been validated against FIPS 140-2 or an equivalent standard. Blowfish is not included in ...
0
votes
0answers
28 views

Was ISO 17799:2005 the first ISO standard to introduce risk management?

I'm doing research into ISO 17799:2005, more specifically its policies related to risk management and its involvement on risk management in the wider IT sector, but I can't find out the answer to: ...
2
votes
1answer
62 views

What is a Security Guideline and how does it stand in relation with Standards, Policies, Procedures?

I'm currently working on the definitions-section of a paper. Therefore I have to define the term "Guideline" and how its relationship to other terms (Standards, Policies, Procedures) looks like. ...
0
votes
1answer
51 views

What's the relation between a Security Framework & Standards, Guidelines, Procedures and Policies?

I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow ...
0
votes
1answer
55 views

Software Signing Standards

Is there a software signing certificates standard, officially or by popularity? As I understand the SSL/TLS/https certificates rules are specified by the RFCs. Mixed use of servers and clients from ...
1
vote
2answers
132 views

Why are email clients prevented from seeing the envelope?

Being able to compare the envelope values against the header field values is potentially useful for detecting fraudulent (e.g. spoofed) mail. However, email servers, when receiving mail over SMTP, ...
1
vote
2answers
180 views

Are there currently any standards for Homomorphic encryption?

I am curious if there are any released standards for homomorphic encryption, or computing on encrypted data. Perhaps by NIST, ANSI, or ISO. If not, are there any that are under development right now? ...
3
votes
2answers
124 views

How do I measure compliance to Information security policies?

I work in an organisation with 3 levels as far as information security is concerned. I'm sitting at level two where we develop policies and also assist with the standards. One of the most difficult ...
0
votes
1answer
159 views

What should be the life time for SMS OTP?

I've tried to find such a standard that mention the lifetime of SME OTP, however, NIST is no longer recommended using SMS OTP due to the risk involved. Regardless of the security concerns, I still ...
0
votes
3answers
108 views

When should TouchID/Fingerprint log-in expire?

I couldn't find such a standard which mention about TouchID or fingerprint log in expiration date. Suppose I have an application and allow users to log in using the fingerprint. I would like to know ...
0
votes
1answer
45 views

Trustable Sources For Security Algorithms and Standards?

I am learner of cryptographic algorithms and security standards. I usually Google it to understand the basics of the algorithm or the protocol, and to find an implementation of a protocol. However I ...
3
votes
1answer
111 views

How to find CAPEC items related to a CVE

Vulnerabilities with a CVE usually also have a CWE associated with them, but almost never CAPEC. CWE's site also only very rarely points to related CAPEC items. Is there a way to find a CVE's ...
1
vote
1answer
23 views

Can I describe the PDF's certificate-based signatures using W3C's DSIG Core?

Can I map the specialized specifications of PDF's certificate-based signatures into the [XML DSIG Core] standard? I'm imagining PDF as an "XML file analog", to be mapped into the W3C's ecosystem. ......
1
vote
1answer
51 views

Is there a standard checksum for verifying multipart key fragments?

We will have a symmetric key arriving in three component parts. Once all parts arrive, the key custodians will get together for a ceremony where each enters their part of the key into a secured ...
2
votes
2answers
130 views

What security standards apply to physical security for an infosec office

I'm looking for actual specific standards that apply to physical access control for Information Security office space. Long story short, our building manager wants an open office concept, and in order ...
-1
votes
1answer
62 views

Standards and Guidelines Pro/Con Anti Malware programs

For a whitepaper about anti-malware products used in combination with (server side) applications and infrastructure components (database server) I am looking for standards, guidelines and codified ...
1
vote
0answers
78 views

Privacy terminology: Online privacy vs Internet Privacy vs Digital Privacy

While, to my eyes, Digital Privacy is the broader term ( anything digital whether online or not), I have seen all 3 used interchangeably (i.e: link vs title). Also, despite having different entries in ...
2
votes
2answers
245 views

Cryptography best practices standard [closed]

I have been searching some standards about cryptography best practices. I have found some articles and books but no official standard. Do cryptography best practices standard exist?
1
vote
0answers
201 views

Offline mobile app data storage Guidelines, Standards

We are currently working on a project to develop an "offline" mobile application that synchronises data with our current cloud software solution that would allow field workers in potential mobile ...
5
votes
1answer
1k views

Why is the SSH maximum packet size 32k?

My question has two parts. First, why must an SSH server have at least a maximum packet size of 32678 bits? It seems a bit excessive for most uses of SSH, excluding file transfer. Is it common for ...
3
votes
1answer
134 views

What does a “-” mean in the Version field in Common Product Enumeration (CPE)?

I'm trying to understand the Common Product Enumeration standard published by Mitre. In the Version field, I've found references to "*" or ANY meaning "Any Version." However, when I search the CPE ...
1
vote
1answer
7k views

Do US Classification Levels have official color values? [closed]

US Classification Levels are used to mark the classification level of documents and files. Each level is indicated by a combination of indicators - include color. Are there official color codes (i.e.,...
0
votes
1answer
244 views

Envelope formats to store (symmetric) encrypted text

We have decided to use AES to cipher user data. So for every data chunk we have the crypted text along with the SALT. Now we have to store both of them in the database and we do not want to separate ...
1
vote
0answers
20 views

How to specify block sizes in algorithm names? [closed]

I'm working with a Ukranian national cipher called Kalyna. For each key size, the cipher can have two block sizes (some hand waiving). For example, Kalyna with a 128-bit key can have block sizes of ...
3
votes
1answer
596 views

Signature in ECDSA-signed X.509 certificates

I wonder if there is a standard way of encoding the ECDSA-signature in the signature field of an X.509 certificate. As far as I understand, the signature is a tuple of two integers r and s. If the ...
0
votes
0answers
49 views

Recognized complement to OWASP's ASVS requirements

The OWASP ASVS focuses on web-application verification. It is free and recognised worldwide as a good reference to build upon, or simply reuse. It is useful to use it when outsourcing web development. ...
5
votes
1answer
151 views

Common passwords among servers/web sites on a development platform

I have been involved in a discussion about the use of a standard user name and password within a development environment and would appreciate comments: The single development server holds a number of ...
4
votes
1answer
431 views

Is there any real-world use of IPsec modes other than ESP tunnel?

Tunnel mode ESP (encapsulated in UDP so that it can traverse IPv4 NAT) is used as the basic building block of most of the modern VPNs that I've used and studied. In it, packets are encrypted and ...
3
votes
1answer
116 views

What is the minimal security standard needed for this type of software product

Actions described in security standards (like ISO 27002, PCI-DSS, HIPAA, Common Criteria) greatly vary according to the domain data that they store, process, transmit and report. We have a product ...
6
votes
1answer
195 views

Attack tree file format?

Wikipedia lists five software packages for creating/editing/analysing attack trees. These software packages do not seem to have settled, between them, upon an agreed file format for attack trees. ...
0
votes
1answer
443 views

What is the best Practice / Industry Standard for storing documents with social security numbers, date of birth, financial records, etc? [closed]

I am building an app that will be storing sensitive info (SSN's, DOB's, Financial Information, Credit Cards, etc. Is there a standard that will cover all these items and what is the best approach to ...
2
votes
2answers
96 views

Are CCE's used anymore?

Obviously CVE's are used extensively for referring to specific vulnerabilities. However, I don't see CCE's referenced very much in regards to configurations. I understand that configuration settings ...
0
votes
1answer
80 views

PCI DSS or PCI Standard - Standards | Requirement | Implementation

I have done ISO 27001 implementation and auditin. I want to get a clear idea of PCIDSS standard. What is PCI DSS (I know the abbreviation) What are all the materials and sites to refer? What are all ...
2
votes
1answer
69 views

Developing Small Business Information Security Standards

I'm looking for some resources and hoping some of you security experts can help. Quick Background: I recently started my first job out of college working at a small organization as a Web Developer. ...
1
vote
1answer
320 views

nodev option for /tmp directory

The CIS standard for Ubuntu 14.04 LTS (01-07-2015) states that the /tmp directory should be mounted with a nodev flag - this is under the FileSystem Configuration (Section 2). This prevents the ...
1
vote
1answer
78 views

Is this a “standard” security policy?

For our development we work primarily on AWS. We have data on S3 with varying levels of security, prod, integration, development, etc. When working with data, we often have to run ad-hoc analysis. ...
0
votes
1answer
583 views

PDF encryption anomaly; version 1.5 using AES

I'm not sure if this is the correct forum to ask this question so please accept my apologies in advance if this is the wrong place. (I have already posted this in the Programmers section but I've yet ...
13
votes
7answers
2k views

What risk rating models are used for calculating risk scores of web vulnerabilities?

What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
0
votes
2answers
88 views

Certifying software as secure

What security certifications do major banks in the US expect an external software vendor to comply with? The software might form part of their payment processing system. ISO/IEC 27001 would apply to ...
4
votes
0answers
71 views

Protocols for transfering access control data

The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and ...
4
votes
1answer
311 views

How relevant is OWASP ASVS? [closed]

How relevant is the OWASP application security verification standard? Have you had it as a requirement made by business? What other application security standards relevant to business are there? I did ...
1
vote
0answers
56 views

How should I authenticate a third party's users on my platform?

I'm having trouble finding implementation ideas / guidance / examples for an authentication system that has the following properties: Allows a third party to carry out actions on our platform on ...
3
votes
2answers
146 views

Cybersecurity Server Stack references

I hear a lot of best practices saying that you should have 2 vSphere server stacks: One for Production One for Cybersecurity For example, your enterprise might have a vSphere environment stack that ...
11
votes
2answers
1k views

What is the current EU standard for data destruction?

I have been hunting around for a couple of weeks trying to find what the current standards for sensitive data destruction in the EU/UK are. If you look at the destruction companies they have several ...
0
votes
1answer
326 views

Are there Secure Coding Standards other that CERT? [closed]

I am familiar with the CERT Secure Coding Standart. Are there also any other secure coding standarts other than the CERT ones?
1
vote
1answer
94 views

History of the CERT secure coding standards? [closed]

My question is when and why did researchers decide to create the CERT secure coding standards? Is there anything about the history of this standards? I can't find anything about this.
20
votes
5answers
3k views

Policy mandate dilemma

When writing security policies do you take into consideration user's (could be vendors) ability/capability to fulfil certain mandates in the policies or do you strictly want them to enforce, no matter ...