Questions tagged [threat-mitigation]

The elimination or reduction of the frequency, magnitude, or severity of exposure to risks, or minimization of the potential impact of a threat or warning.

Filter by
Sorted by
Tagged with
0 votes
0 answers
91 views

How to Safely Research a Suspected Malicious Website by Using A VM [duplicate]

I am aware of a website that I suspect is, at the very least, pulling user data from visitors and possibly performing other malicious activity on visitors. Of course, the safest course of action is to ...
Evan Leahy's user avatar
0 votes
0 answers
76 views

Is there any increase to known security risks by mounting the EFI System Partition, on a Windows 10 PC?

Security risks, as in malware, attackers, or known vulnerabilities. Threats while the ESP is mounted, or after unmounting. E.g. Could it open access routes for future attackers. I aim to avoid ...
Eric's user avatar
  • 1
2 votes
0 answers
62 views

What to do in case of an MDM solution admin account takeover?

My company recently switched to an MDM solution to manage our Apple computers fleet. This is all good and well to maintain up-to-date software, and make handle lost/stolen laptop issues. But I can ...
securious's user avatar
0 votes
1 answer
534 views

What threats can the use of a TPM by a password manager mitigate?

This question is about the use of a TPM by a password manager used by an end-user on a PC to store and use passwords to log in to web sites and other things that are protected only by a password. ...
alx9r's user avatar
  • 569
3 votes
3 answers
577 views

What are the security implications of using an old computer with no more BIOS updates?

What are potential security implications of using older unsupported motherboards/laptops that do not get BIOS(UEFI) updates anymore, but run an up to date GNU/Linux distribution? Do measures like ...
Dan Johnson's user avatar
1 vote
1 answer
86 views

Static react native app security issues

I am creating a react native mobile application using Expo. This app simply renders information - there is no data collection or entry, no user accounts, no database (other than JSON storage). There ...
server_unknown's user avatar
0 votes
3 answers
523 views

Why do some VPN block internet access?

Some of the VPNs at work block internet access once you are connected. I understand if the incoming (or even outgoing) traffic from some servers are not allowed. But why all the client machines that ...
gdenuf's user avatar
  • 101
1 vote
1 answer
92 views

What are some of the ways of identifying trade-offs between security & privacy? [closed]

Privacy can mean different things to people. Protecting one's identity from autocratic regimes to ex-boyfriend/girlfriends/partners. Threat modeling goes some way in understanding actors and the ...
fenixleon's user avatar
  • 301
1 vote
0 answers
48 views

Is removing the `${jndi:` string a mitigation of the log4j security issue? [duplicate]

Recently, the log4j issue got a lot of attention. I run a chatbot web app that is not based on the JAVA stack. However, there is a backend component that analyzes the chatbot user input which is based ...
Iching Chang's user avatar
2 votes
1 answer
339 views

What precisely about Zoom is not secure? [closed]

My agency (which isn't a high security-risk, top-secret place) has an almost zero tolerance rule for Zoom and I am curious why. We are told to use WebEx instead but I fail to see why WebEx is more ...
honeste_vivere's user avatar
1 vote
1 answer
119 views

How to rate a CVSS Score if OS/compiler vulnerablity mitigations are highly likely but not guaranteed?

Let's consider the following code in a hypothetical C library. uint8_t size; uint8_t buf[128]; read(untrusted_fd, &size, 1); read(untrusted_fd, buf, size); In the early 2000s, it would be a ...
比尔盖子's user avatar
1 vote
1 answer
229 views

Is server side CORS protection enough to mitigate CSRF attacks against stateless APIs?

Assume an Angular SPA application on www.example.com that works invoking an API over that same domain www.example.com/api/... The Angular app gets a session cookie and sends it in each API call. The ...
codependent's user avatar
2 votes
1 answer
2k views

What is the difference between ATT&CK and CAPEC?

My question is on Cyber Threat Intelligence (CTI). I want to know the difference between Attack Patterns (as in MITRE CAPEC) and Tactics, Techniques and Procedures (as in MITRE ATT&CK). They both ...
JacopoStanchi's user avatar
0 votes
1 answer
207 views

Are security controls themselves considered assets (e.g., cryptographic keys)

Looking at a plain system (there are no security controls implemented yet), we need to think about its functions and derive appropriate assets which we'd like to protect in order to ensure the system ...
smoothware's user avatar
2 votes
2 answers
446 views

Is Power Failure an Environmental or Structural Threat?

According to the CySA SYBEX book, in chapter 1, power failures are listed as both environmental threats and structural threats... but which one is it? According to the book: Environment threats occur ...
talkinggoat's user avatar
1 vote
1 answer
5k views

What is the difference between "local" and "Adjacent" threat agents?

I am using CVSS to do the vulnerability assessment for my project. As per documentation here is the definition of local and adjacent Adjacent (A) The vulnerable component is bound to the network ...
kudlatiger's user avatar
0 votes
0 answers
98 views

How to monitor the internet at large for threats to your organization?

What are approaches for monitoring cyber threats “outside” of the organisation, such as data like account passwords, credit cards, company data for sale, etc? While there are services for monitoring ...
stephan's user avatar
  • 101
3 votes
4 answers
274 views

How do I minimize the number of passwords leaked when a PC gets compromized?

For customer support reasons, we need to store passwords to some of our customers' systems (with their explicit, written permission, of course), as well as, obviously, passwords to some of our own ...
Heinzi's user avatar
  • 3,078
3 votes
0 answers
221 views

What is the Meow Attack and how can I guard my databases against it?

Recently, there has been some news articles about unsolicited attacks on unsecured public facing Elastic and Mongo databases. These are commonly being called "Meow" attacks, resulting in ...
MDMoore313's user avatar
1 vote
2 answers
305 views

Does HTTPS protect mobile internet connections against "network injection"?

The Star recently published an article describing an alleged attack against a Moroccan journalist. The article describes the attack as such: Forensic evidence gathered by Amnesty International on ...
jmcph4's user avatar
  • 163
3 votes
1 answer
1k views

Does TLS 1.3 mitigate the BREACH vulnerability?

Section 5.4 of the TLS 1.3 specification describes record padding. One of the mitigations for BREACH is to add random padding. Therefore, I'm wondering: Does TLS 1.3 require random record padding? I'...
candrews's user avatar
  • 131
1 vote
1 answer
261 views

Can VPN hardware provide adequate isolation on a home network? [closed]

If you were to configure a Work PC at home to exclusively connect to your work network via a small VPN box, would this adequately isolate it from your home network and related threats? What ...
Tony O'Hagan's user avatar
1 vote
1 answer
176 views

Threat modeling for visitor access control

I am trying to understand threat modeling but it seems too elasti from restrictive requirements to general requirements. Now i am trying to understand it with some realistic examples. The first ...
user3488903's user avatar
0 votes
0 answers
35 views

How to secure an open port and public IP address when clients must connect to it [duplicate]

I do not have a lot of experience in networking, however, I have built a live-chat application using socket.io and nodeJS. In order to do this, I had to open a port to allow other networks to connect. ...
Meliodas278's user avatar
0 votes
2 answers
1k views

Accidentally Shared my Private Key - How to Remedy?

I accidentally shared my SSH private and public keys with others. I changed keys within 2 minutes of sharing the private key. I've since added a password to access my private key as well as deleted ...
user227946's user avatar
4 votes
0 answers
213 views

How to mitigate insecure password policy that I am forced to use?

The site in question is the UK regulator for companies at https://ewf.companieshouse.gov.uk. Online access to a company on this site enables the user to file/change various critical things on behalf ...
Jon Bentley's user avatar
  • 2,071
5 votes
2 answers
3k views

How are websites actually mititating BREACH? (HTTPS + compression)

After reading some popular questions and answer on this website about BREACH, the only advice seems to be: don't compress anything that might contain secrets (including CSRF tokens). However, that ...
reed's user avatar
  • 15.8k
1 vote
1 answer
259 views

Malware Threat Hunting in Airport Systems - KPIs/Metrics to Track [closed]

I am trying to figure out how to detect potential threats from malwares in various systems installed in the airport. To be specific, my focus is on the following systems in airports: Baggage ...
SamRoy's user avatar
  • 111
1 vote
0 answers
811 views

Preventing Linux brute force concurrent su/sudo attempts

Its well known that popular Linux distros use the PAM default to slightly delay incorrect login attempts, thus mitigating brute-force attacks against a user account (for example, running su repeatedly ...
tasket's user avatar
  • 191
0 votes
2 answers
736 views

Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191

I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
pinpwn's user avatar
  • 1
11 votes
2 answers
1k views

What are the new MDS attacks, and how can they be mitigated?

Several new hardware side-channels were discovered called MDS attacks, which allow reading arbitrary memory, like Meltdown. Many existing mitigations are useless against them. The relevant CVEs are: ...
forest's user avatar
  • 66.6k
-1 votes
1 answer
132 views

How can I mitigate the possibility of SSL private key being copied without my knowledge?

OCSP stapling and Certificate Transparency logs seem to provide a pretty good defense against man-in-the-middle attacks if I discover that my private key has been stolen. I can revoke my old ...
duggulous's user avatar
  • 401
2 votes
1 answer
2k views

What is the difference between Anti - APT (Advanced Persistent Threat) and ATP (Advanced Threat Protection)?

Like the question says, is it the naming difference only or are they entirely different?
Regmi's user avatar
  • 125
4 votes
0 answers
308 views

Do programs run in Linux in Wine benefit from DEP and ASLR?

Do programs run in Linux in Wine benefit from mitigation techniques DEP and ASLR?
KOLANICH's user avatar
  • 912
1 vote
1 answer
205 views

Will removing the harddrive from a computer protect it from persistent malware?

If I took a clean computer/laptop and removed the harddrive, lock the BIOS with a password, then did all my work from a live OS like Knoppix, will this help reduce the risk of persistent malware ...
user942937's user avatar
1 vote
2 answers
227 views

Classification of countermeasures for family of vulnerabilities

I would like to know if anyone of you has already read about some models that would classify a set of possible countermeasures against a family of vulnerabilities. What I mean by a 'family of ...
Ecterion's user avatar
  • 103
0 votes
1 answer
619 views

Does Windows 10 provide sufficient virus and threat protection? [closed]

I am configuring a new laptop with Windows 10 Home and trying to determine if it is necessary to buy one of the big antivirus packages such as Norton, McAfee, etc. Is the security software that comes ...
Borealis's user avatar
  • 101
2 votes
1 answer
167 views

How to reuse a rewritable DVD from an unknown source?

I have a used rewritable DVD that I want to wipe and use to store new data. The DVD has been written to before by someone I don't know and can't necessarily trust. Is there a safe way to use the disc? ...
Zach Boyd's user avatar
  • 123
0 votes
0 answers
97 views

Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?

One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
Filipon's user avatar
  • 1,264
1 vote
1 answer
212 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
Jaya Anand V's user avatar
-1 votes
1 answer
188 views

How to calculate the priority and the severity of our daily cyber security intelligence threat feeds?

Some solutions (eg. FireEye ISight) can provide a daily feed where they will mention each reported issue with it's severity and priority. Usually those companies will do some basic research and look ...
Filipon's user avatar
  • 1,264
2 votes
2 answers
433 views

How should we mitigate threats that are keep coming to our security monitoring system?

We have continuous cybersecurity threat feeds that coming to our SOC on a daily basis from different sources that provide all the new CVEs, new malware variations and more. We just don't know how to ...
Filipon's user avatar
  • 1,264
3 votes
3 answers
268 views

How should we implement responsible discovery program internally only for our organization employees?

We experienced a very interesting phenomenon in the last 6 months and that is that some employees found and reported to our security teams few very crucial security issues. We were thinking about ...
Filipon's user avatar
  • 1,264
1 vote
2 answers
266 views

How to mitigate the risks of using new, third party imported electronic accessories?

As someone who is naturally good at recognizing risk and who are striving to maintain a wholistic view on security, I’m wondering how to evaluate and reduce the risks of hardware accessories (I.e. ...
dopeideas's user avatar
9 votes
1 answer
2k views

Mitigating the new attack on WPA2 involving PMKID

A new attack was discovered which allows cracking a WPA2 passphrase without needing to capture the 4-way handshake. While this doesn't weaken the password itself, it does mean that an attacker can ...
forest's user avatar
  • 66.6k
1 vote
1 answer
825 views

What are the risks of placing Amazon Resource Names (ARNs) in VCS repositories?

Amazon Resource Names (ARNs) uniquely identify AWS resources. Amazon requires an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational ...
FrancisV's user avatar
  • 111
1 vote
1 answer
152 views

Operation Prowli Malware Infects Over 40,000 Machines

Seems a new malware infection has been detected called 'Operation Prowli Malware' and around 40,000 machines are infected. Still no CVE data updated on CVE site regarding the relevant vulnerability. ...
Sayan's user avatar
  • 2,049
4 votes
3 answers
868 views

What is the quick fix for CSRF attack?

The application is constructed in Java language and JSF framework. I have reported a CSRF attack and the development team have to fix it soon since the application is in production. I recommended to ...
Ekalavya's user avatar
  • 164
1 vote
1 answer
867 views

What are the security risks of running a daemon as root even though SELinux is enforcing?

On an board running Linux I see a daemon and an utility run under root when started. The SELinux is enforcing for this system. Are there any potential threats of running as root, even if the SELinux ...
sob's user avatar
  • 225
5 votes
0 answers
2k views

Is Cross Site History Manipulation (XSHM) still relevant?

XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
Shurmajee's user avatar
  • 7,437