All Questions

Filter by
Sorted by
Tagged with
12
votes
5answers
6k views

How can I securely authenticate the client application sending me data?

We have a web service logging/recording user data sent over https by our client application. Is there a way to securely ensure that the data is getting sent by the client application and not by a fake ...
16
votes
3answers
4k views

Reporting vulnerable sites

Take this scenario: You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact ...
7
votes
4answers
1k views

Benefits of secure code review in-IDE vs. fatapp vs. webapp

For those of you who have worked with commercial secure code review tools such as: Klocwork Coverity Armorize Fortify Checkmarx Appscan Source Edition (formerly Ounce) Or perhaps a free or open-...
14
votes
11answers
2k views

For users that does not use PGP, what would be the other channel to securely send them a document?

I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email. The real question is how to do that? ...
2
votes
5answers
2k views

Anyone using Asirra in production? Are there similar alternatives?

The Asirra project is a Captcha alternative that shows you pictures of kittens and puppies to fend off bots and prove that the end user is a human. Is anyone using Asirra (or something similar) in ...
29
votes
7answers
3k views

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
11
votes
3answers
661 views

What security requirements do you have for Domain Administrators?

With regard to managing a Windows network, what security polices and processes do you use? For example Do you require/support Smart Card Authentication? Restrict logins from a particular workstation? ...
6
votes
2answers
209 views

Managing a team of IDS experts; how would you organize your team?

Suppose you are managing a team of Intrusion Detection Experts: ...what are the functional areas of the IDS knowledge space would you group your team into? ...how would you structure your team? .....
4
votes
2answers
291 views

What does a MCSE need to learn to be proficient regarding *nix security?

I have a top notch Windows MCSE/MCSD (developer) who wants to broaden his skills with Linux security... but needs to update his skills from the Ultrix / Yellowpages days of 40 years ago. What ...
3
votes
2answers
178 views

When would you support the storage of Security & Application event logs in the Cloud?

Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises? When would you consider a SaaS /hosted solution and what value add should that ...
7
votes
3answers
553 views

What tools are available for distributing and syncing firewall rule-sets to multiple devices?

I am looking for a solution to be able to distribute and sync firewall rule-sets to multiple devices. There are a few solutions out there such as Playbook by Matasano but it comes with an expensive ...
13
votes
7answers
4k views

Egress filtering on an office network?

With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
21
votes
2answers
4k views

How secure is Keychain on OS X?

Keychain is a built-in app on OS X that stores all of the user credentials, and allows for one to keep encrypted notes in an easily accessible way. Does anyone know how secure Keychain is? I know ...
21
votes
2answers
30k views

How does basic HTTP Auth work?

How does basic HTTP Auth work?
29
votes
11answers
9k views

Password Management within an Organisation

Within an organisation there are many passwords such as those for root accounts on servers, hosting accounts, router logins and other such things, that need to be kept track of. I know in some ...
2
votes
2answers
312 views

Is WCF or Java Metro security configuration in-scope for your security department; should it be?

Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet. Given the port sharing abilities of IIS, or even that a web ...
10
votes
6answers
483 views

Should we configure all devices to never request SSL 2.0, and reject it if offered?

In an effort to reduce man in the middle attacks, when will it be (or was it) an industry accepted practice to reject SSL 2.0 connections on the client and server side? Is configuring this on a proxy ...
2
votes
2answers
7k views

Is it possible to change the admin user/password remotely on a router without logging in? [closed]

Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
8
votes
3answers
2k views

What does a court need to successfully prosecute a hacker? Please cite previous cases if possible [closed]

Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that: Integrity of the investigation is maintained The ...
6
votes
2answers
4k views

What are the security risks of the Service Bus, and how do you mitigate them?

The Service Bus is software that can be installed on Windows or rented on Azure and allows someone to relay SOAP/WCF information over the internet in the form of a XML over HTTPS payload. One risk ...
8
votes
2answers
612 views

What features do you look for in an Enterprise Log Management solution?

This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log ...
21
votes
1answer
13k views

Is SOCKS secure?

In order to create a VPN, I open an SSH tunnel with a command like ssh -D 9000 user@host, and then I set my system's proxy settings to use SOCKS5 through localhost:9000. Well, setting up my home ...
9
votes
2answers
1k views

Does DNSSec have any benefit if used with IPSec-enabled IPv6?

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec? Is DNSSec an IPv4-only technology?
10
votes
2answers
3k views

How do the root servers get updated with my name server? Is WhoIS information always in sync with the root?

I've never understood what happens behind the scenes when I go to my registrar and enter in my name server's information. Can someone elaborate on what happens when an update is made, and how it is ...
5
votes
1answer
227 views

When should a DNS entry be cached? What conditions should not be? How do I determine the TTL?

I'm writing a DNS resolver and am building a spreadsheet of when a DNS record should be cached, and not be cached... but it's harder than it first looks (to me at least). Is there consolidated test ...
5
votes
2answers
282 views

What risk do International Domain Names (IDN) pose?

I understand that IDN's are basically a GUI display change for domains that have a prefix of "xn--". What should I advise companies do in regards to these domains? For example, should companies ...
3
votes
2answers
209 views

What International laws should one in the InfoSec industry we be aware of?

What InfoSec regulations should one be aware of when dealing with 'live' cross-border communications, or the offline transport of information?
8
votes
5answers
4k views

What security requirements are a defacto standard in the Financial Industry?

What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry? If you're familliar with the Financial Industry, can you share details? For example: What ...
27
votes
2answers
51k views

What are the differences between the versions of TLS?

Please correct me if I'm wrong, but my understanding is that SSLv3 and TLSv1 is just a rename of the earlier protocol... but TLSv1 adds the ability to have secured and unsecured traffic on the same ...
4
votes
0answers
688 views

Best website to learn computer security basics? [duplicate]

Possible Duplicate: Resources to learn about security Can someone advice on which are the good sites out there to learn the basics of computer security from?
28
votes
21answers
7k views

What are the biggest unsolved problems in IT Security? [closed]

Just recently I thought about all the solved problems in IT security, like XSS (which one can mitigate with input validation), SQL Injection (mitigated with prepared statements), etc. Now I'm ...
7
votes
2answers
621 views

I am looking for feedback on Secure Development Lifecycle for Scrum that has been tested?

This question is indeed targeting SDL but for Scrum. The A-SDL from Microsoft is nice, but honestly I am not even daring testing it in reality as it seems too academic. I mean what they request for, ...
7
votes
2answers
168 views

“Fingerprinting” and human error

Pretend for a moment I am investigating an attack. I find errors in the attack method (mistakes made by the human attacking my network/computer). I compile a database of these "mistakes" treating ...
17
votes
3answers
2k views

Multi factor authentication on Ubuntu workstations, where to start?

Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed) ...
2
votes
2answers
2k views

Is it possible to take down a site using javascript in the URL bar?

If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?
5
votes
3answers
387 views

Strategy against browser exploits on Windows?

On a friend's computer is some kind of spam bot installed. It sends messages like Hello: I received my apple iPad 32GB ordered on an online shop (www.elevalley.com ) today. So exciting , ...
17
votes
6answers
737 views

What policies maximize employee buy-in to security?

Security awareness training is a bane to most employees. A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from ...
55
votes
38answers
12k views

What is your way to create good passwords that can actually be remembered?

What are the methodologies which can be used to generate "human" good quality password? They have to ensure a good strength and also easy to remember for a human being.
3
votes
2answers
262 views

How does LiveID work? Is there any documentation on the LiveID provisioning site msm.live.com?

I'm trying to learn details on how LiveID works, when compared to other federation technologies. To be honest, I'm a bit overwhelmed by all the options at https://msm.live.com/ and want to understand ...
7
votes
2answers
8k views

What is the exact difference between SAMLp and WS-Trust?

They seem to be similar on the surface, but I'm not sure how deep the differences are. Can someone explain to me the difference between SAMLp and WS-Trust? ADFSv2 gives me a choice between these ...
0
votes
1answer
2k views

How can I decrypt ADFS-based SAML/p or WS-Trust claims?

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication. What private keys do I need and how would I decrypt this information? If it makes any difference, I'm ...
3
votes
3answers
7k views

How does a website owner decrypt ASP.NET's Viewstate, and cookies

I'd like to audit my viewstate for information I don't want to be sent down to the client. What are the steps needed to decrypt this information into human readable form? How would I decrypt the ...
7
votes
3answers
4k views

What's involved in taking over someone else's domain name?

I'm asking this for purely academic reasons. I know that there are domain record lists and whatnot, but I'm trying to understand the exact structure of how DNS works and where someone can potentially ...
4
votes
3answers
137 views

Is it necessary to protect user data if they know and agree to it being insecure?

If I'm running a website that, say, takes a survey, must I protect user data from disclosure if the users are informed initially that it's insecure? I'm not storing financial data or social security ...
17
votes
9answers
8k views

Why do people say that PHP is inherently insecure?

I've heard it said that PHP is inherently insecure. Is this true? Why?
8
votes
3answers
879 views

How does an attacker approach a website?

What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?
6
votes
3answers
198 views

What policies maximize incident detection (and compromise detection)?

What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
12
votes
2answers
650 views

What is considered the simplest (or lightest) secure development lifecycle?

Microsoft has there simplified SDL: "The Security Development Lifecycle (SDL) is a security assurance process that is focused on software development." "The process outlined in this paper sets ...
24
votes
5answers
2k views

Does PCI compliance really reduce risk and improve security?

Might as well bring this hot topic to here! For those not in the know: https://www.pcisecuritystandards.org/
2
votes
4answers
476 views

Does outsourcing infrastructure services reduce risk (and improve security)?

I've been on a kick mentioning to particular clients to quit managing their own dns, email, blogging platform, file transfer setup, etc. This from observing how poor they are at practicing good ...

15 30 50 per page