Questions tagged [threat-mitigation]

The elimination or reduction of the frequency, magnitude, or severity of exposure to risks, or minimization of the potential impact of a threat or warning.

Filter by
Sorted by
Tagged with
1
vote
2answers
124 views

How to mitigate the risks of using new, third party imported electronic accessories?

As someone who is naturally good at recognizing risk and who are striving to maintain a wholistic view on security, I’m wondering how to evaluate and reduce the risks of hardware accessories (I.e. ...
1
vote
1answer
68 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
1
vote
0answers
48 views

Preventing Linux brute force concurrent su/sudo attempts

Its well known that popular Linux distros use the PAM default to slightly delay incorrect login attempts, thus mitigating brute-force attacks against a user account (for example, running su repeatedly ...
4
votes
2answers
1k views

Is there an equivalent of Control Flow Guard for Linux?

Introduced by Microsoft in recent versions of Windows and its compilers, Control Flow Guard is a useful defence in depth measure in the mitigation of return-oriented programming exploits. My question ...
0
votes
0answers
43 views

Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191

I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
138
votes
12answers
31k views

Is public Wi-Fi a threat nowadays?

In my opinion, arguments we have been using for years to say that public Wi-Fi access points are insecure are no longer valid, and so are the recommended remedies (e.g. use VPN). Nowadays, most sites ...
1
vote
1answer
44 views

Classification of countermeasures for family of vulnerabilities

I would like to know if anyone of you has already read about some models that would classify a set of possible countermeasures against a family of vulnerabilities. What I mean by a 'family of ...
10
votes
2answers
731 views

What are the new MDS attacks, and how can they be mitigated?

Several new hardware side-channels were discovered called MDS attacks, which allow reading arbitrary memory, like Meltdown. Many existing mitigations are useless against them. The relevant CVEs are: ...
-1
votes
1answer
66 views

How can I mitigate the possibility of SSL private key being copied without my knowledge?

OCSP stapling and Certificate Transparency logs seem to provide a pretty good defense against man-in-the-middle attacks if I discover that my private key has been stolen. I can revoke my old ...
1
vote
1answer
198 views

What is the difference between Anti - APT (Advanced Persistent Threat) and ATP (Advanced Threat Protection)?

Like the question says, is it the naming difference only or are they entirely different?
0
votes
0answers
26 views

OIDC Protocol :: Different OIDC Server End points

OIDC Specifications: Authorization Code Grant Flow. As OIDC Server is shall list the various end points (Auth EP, Token EP, Token validation EP etc.) In this scenario, Can Auth End Point and Token End ...
2
votes
3answers
1k views

What are the risks of a rogue Access Point? What lessons can be learned from the Wifi Pineapple?

I'd like to educate colleagues and peers on rogue access points using the tool "Wifi Pineapple". What are some specific security-related lessons I could demonstrate? If applicable, what are the ...
3
votes
0answers
56 views

Do programs run in Linux in Wine benefit from DEP and ASLR?

Do programs run in Linux in Wine benefit from mitigation techniques DEP and ASLR?
1
vote
1answer
115 views

Will removing the harddrive from a computer protect it from persistent malware?

If I took a clean computer/laptop and removed the harddrive, lock the BIOS with a password, then did all my work from a live OS like Knoppix, will this help reduce the risk of persistent malware ...
1
vote
2answers
243 views

How should we mitigate threats that are keep coming to our security monitoring system?

We have continuous cybersecurity threat feeds that coming to our SOC on a daily basis from different sources that provide all the new CVEs, new malware variations and more. We just don't know how to ...
2
votes
1answer
5k views

Is it possible to spoof a paired Bluetooth device?

I'm thinking about creating a physical lock, where the keys would simply be paired Bluetooth devices, but I'm concerned about the potential (in)security. I would like to have a Bluetooth 2.1 module ...
0
votes
1answer
106 views

Does Windows 10 provide sufficient virus and threat protection? [closed]

I am configuring a new laptop with Windows 10 Home and trying to determine if it is necessary to buy one of the big antivirus packages such as Norton, McAfee, etc. Is the security software that comes ...
5
votes
1answer
125 views

What is “half PFS” protection, and what protocols or configurations apply to it?

I'm looking for a list of scenarios and protocols that are vulnerable (or not vulnerable to) half-PFS protection. Half PFS, as I understand it, is where the communication between a client and server ...
2
votes
2answers
305 views

Is using cat -v an appropriate way to sanitize untrusted text?

It is well known that a terminal tends to trust things which are printed to it through stdout/stderr, making outputting attacker-controlled data to the terminal a risky action. Is using cat -v an ...
2
votes
1answer
88 views

How to reuse a rewritable DVD from an unknown source?

I have a used rewritable DVD that I want to wipe and use to store new data. The DVD has been written to before by someone I don't know and can't necessarily trust. Is there a safe way to use the disc? ...
0
votes
0answers
45 views

Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?

One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
3
votes
3answers
216 views

How should we implement responsible discovery program internally only for our organization employees?

We experienced a very interesting phenomenon in the last 6 months and that is that some employees found and reported to our security teams few very crucial security issues. We were thinking about ...
-1
votes
1answer
70 views

How to calculate the priority and the severity of our daily cyber security intelligence threat feeds?

Some solutions (eg. FireEye ISight) can provide a daily feed where they will mention each reported issue with it's severity and priority. Usually those companies will do some basic research and look ...
8
votes
9answers
4k views

Should I block visitors who seem to be probing my site?

I have detected some attempts to probe the security of my site. Should I blacklist their IP address? What are the considerations or tradeoffs to use in deciding when to block their IP address and ...
9
votes
1answer
1k views

Mitigating the new attack on WPA2 involving PMKID

A new attack was discovered which allows cracking a WPA2 passphrase without needing to capture the 4-way handshake. While this doesn't weaken the password itself, it does mean that an attacker can ...
0
votes
0answers
32 views

OAuth2 and linking resources of one owner to another person account

I'm implementing client side OAuth and I'm worried about the following scenario. There is application A registered with service B that is offering access to its user resources - authorized by OAuth (...
0
votes
1answer
106 views

What are the risks of placing Amazon Resource Names (ARNs) in VCS repositories?

Amazon Resource Names (ARNs) uniquely identify AWS resources. Amazon requires an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational ...
1
vote
1answer
98 views

Operation Prowli Malware Infects Over 40,000 Machines

Seems a new malware infection has been detected called 'Operation Prowli Malware' and around 40,000 machines are infected. Still no CVE data updated on CVE site regarding the relevant vulnerability. ...
4
votes
0answers
1k views

Is Cross Site History Manipulation (XSHM) still relevant?

XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
4
votes
3answers
302 views

What is the quick fix for CSRF attack?

The application is constructed in Java language and JSF framework. I have reported a CSRF attack and the development team have to fix it soon since the application is in production. I recommended to ...
1
vote
1answer
88 views

What are the security risks of running a daemon as root even though SELinux is enforcing?

On an board running Linux I see a daemon and an utility run under root when started. The SELinux is enforcing for this system. Are there any potential threats of running as root, even if the SELinux ...
1
vote
2answers
1k views

Threat Modelling Examples (Distributed Systems)

I have threat modelled applications in the past, but I'd like to threat model a distributed system. However for other people I'm with, who have never done it at all, I'd like to check out some ...
3
votes
1answer
2k views

Is the Struts2 token interceptor a viable way of protecting against CSRF?

I'm currently implementing the default Struts2 token interceptor on all of our forms as a measure against CSRF (making a user unknowingly execute an action on our product by visiting another website ...
1
vote
1answer
75 views

How can websites with URL traversal functionality protect itself from revealing its IP?

A good number of websites these days are not served directly over the internet, but through an intermediate providers, such as Cloudflare and Incapsula. A basic premise of the security provided by ...
4
votes
2answers
326 views

Understanding Prevention, Detection, and Protection

I am always confused between Prevention, Detection, Protection. Which one is before the another? I'd say Prevention --> Detection --> Protection. Is that valid?
2
votes
1answer
388 views

Has any exploit leveraged a Video Driver flaw in WebGL?

Microsoft delayed support for WebGL due to the fact Javascript could exploit driver weaknesses. In the years that have past, in WebGL's adoption, are there any exploits of WebGL that supports their ...
2
votes
1answer
155 views

What is “Intentionally misleading Artificial Intelligence to create a misleading outcome” called?

I'm writing about a computer system that relies on Artificial Intelligence and the threats that this may include. One threat vector (for example) is to seed Bayesian AI with content to skew the ...
5
votes
1answer
1k views

ASLR Randomization BSS

Here is some code: #include <stdio.h> #include <string.h> char globalbuf[256]; void function(char *argv) { char localbuf[256]; strcpy(localbuf, argv); strcpy(globalbuf, ...
3
votes
2answers
378 views

How do I secure my home Wi-Fi network in light of KRACK? [duplicate]

Now that KRACK has been discovered to exploit WPA2, is it still possible to secure my home Wi-Fi network? If so, what steps should I take to secure it against KRACK attacks? Will there now be a need ...
-1
votes
1answer
87 views

Why aren't more wifi points compromised? [closed]

Especially in light of the recent KRACK problem. Wifi has been compromised before; and undoubtedly it will again. So I have to wonder, why don't criminal organizations travel around major cities, ...
1
vote
0answers
33 views

Removing suspect MITM certificate while only knowing Date Issued?

A Blue Coat type of certificate was added to my personal PC to access a business network which I could trust at the time, but I don't trust the certificate issuer (Blue Coat) in general and don't ...
1
vote
1answer
274 views

Handling toxic data in a microservice architecture

I'm trying to apply the principle that data is toxic asset in a system with many services through which this toxic asset must flow. The system can be abstracted to 3 actors: clients, intermediaries, ...
2
votes
3answers
2k views

Mitigation against MITM at Starbucks

Free public WiFi, for example Starbucks, is convenient. I wonder if there is a way to verify that a laptop has connected to the Starbucks wireless router and not to a man in the middle that tricked ...
1
vote
0answers
182 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
1
vote
1answer
100 views

Is there a safe way to upload a malware into a centralized server?

I'm facing an issue which i need to upload files to a centralized server, then relay it to other malware analysis providers (Palo Alto / etc...) As from security perspective - it's forbidden for the ...
-1
votes
1answer
83 views

Can browser emulation create vulnerabilities?

If a browser is not authorized on a network, can browser emulation within an authorized browser create vulnerabilities? For instance, Chrome is unauthorized but if I run IE, press F12 to get into ...
12
votes
1answer
5k views

How does adding a random serial number improve a certificate's security?

This article says: "Finding collisions is a tricky process, since it requires you to muck with the bits of the public key embedded in the certificate (see this paper for more details). Also, ...
1
vote
2answers
1k views

Preventing a Brute Force Attack on API via limiter

I have an API that users can log into. I don't want it to be hacked. What if I limit each user to 60 requests a minute? Won't this significantly slow hackers down in a brute force situation?
2
votes
4answers
739 views

Is older software safer to use? [closed]

Is software (and even hardware) that is a few years old safer to use than something that's only been out for a few months? On GRC Security I remember the author cautioning against Windows 7 as it ...
45
votes
5answers
6k views

Should web applications that are only accessible from a LAN be held to the same security standards as publicly accessible websites?

Many security measures are intended to protect against hostile users who want to abuse the software or get access to content they don't have permission to access. Things like CSRF protection, SQLi ...