All Questions
67,190
questions
26
votes
11
answers
3k
views
What are security issues which are specific to cloud computing?
Moving almost everything to the Cloud gradually becomes a mainstream.
Are there any security issues, which appeared together with this trend?
What everybody should check out, from the security point ...
- 2,117
8
votes
1
answer
551
views
What steps do you take to keep both your computer and internet browsing secure? [closed]
I am thinking about your browser setup, antivirus protection, vpn, browsing best-practices and so on.
- 2,020
28
votes
4
answers
29k
views
What benefits does Nessus have over OpenVAS?
Nessus and OpenVAS appear to have fairly similar features. Why would you choose one over the other, besides the benefit of commercial support (which isn't available for Nessus Home Feed users anyways)?...
- 19k
74
votes
5
answers
128k
views
Advantages and disadvantages of Stream versus Block Ciphers
Encryption algorithms such as Blowfish,AES,RC4,DES and Seal are implemented in one of two categories of ciphers. What are the advantages/disadvantages to the type of ciphers?
- 3,291
14
votes
1
answer
2k
views
Which files are more insecure than others?
Regarding the fact (in case it's not always the proven fact, then an opinion) that there are types of files more safe for handling them after getting from the Internet than the other, I'd like to ask:
...
- 2,117
12
votes
2
answers
2k
views
Antivirus, antimalware and antispyware software. What is the difference?
What is the difference between antivirus, antimalware and antispyware software? If any clear distinction can be defined.
- 2,117
25
votes
4
answers
4k
views
IPsec (Internet Protocol Security) facts
Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
- 3,291
13
votes
4
answers
2k
views
Vulnerabilities common only in mobile solutions?
I was wondering if there are any threats for web-applications used on mobile phones that haven't been known in the "full size" browsers earlier.
I haven't heard of any serious or common problems that ...
- 1,115
11
votes
3
answers
895
views
What security features should be present in every web-based CMS?
What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do?
Please note: I'm looking ...
- 3,232
10
votes
3
answers
1k
views
How to open a file from the Internet in a secure way?
Sometimes I have to open files (doc, zip, txt, pdf and some other) downloaded from the Internet (from unproven sites) on my computer.
How could I mitigate the risk and open them in a more or less ...
- 2,117
33
votes
6
answers
3k
views
Are online password managers secure?
Can online password managers be used for storing and managing passwords? I mean from the security point of view. I understand that those systems can be different and some deserves more trust than the ...
- 2,117
24
votes
3
answers
8k
views
How does a crypter for bypassing antivirus detection work?
I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?
- 2,020
22
votes
4
answers
7k
views
Malwares source repositories. Where? [closed]
As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
- 2,020
12
votes
2
answers
2k
views
How to test against DDoS in a controlled enviroment?
Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?
- 2,020
10
votes
1
answer
5k
views
Management Network Best Practices
I am looking at setting up a Management vlan, on which I will put all the Management interfaces for my various networkable devices (Firewall Mgmt Interfaces, Server RAC, WAP Mgmt Interfaces, etc).
...
- 1,377
28
votes
11
answers
9k
views
Resources to learn about security
I am currently just finishing a undergrad computer science degree, but I know very little about computer security.
What are some good resources (aside from this site) to learn the fundamentals of ...
- 381
21
votes
4
answers
11k
views
What is the benefit with using encrypted RAM?
I sometimes hear that encryption is used for the RAM, but I don't really understand why this is needed.
Why is RAM needed to be encrypted? And is this done by the hardware, the operating system or ...
- 5,163
12
votes
4
answers
7k
views
How effective are reverse proxies as a web application security measure?
How effective are reverse proxies as a web application security device? Which types of threats do they mitigate against and which don't they?
For example are they more effective in preventing ...
- 1,267
82
votes
13
answers
26k
views
What are the pros and cons of site wide SSL (https)?
What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
- 5,079
12
votes
3
answers
2k
views
If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?
In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the key/password/...
- 2,237
15
votes
3
answers
4k
views
How do I get started using ESAPI WAF?
I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
- 351
11
votes
1
answer
1k
views
Are browsers still vulnerable to Cross-Site Cooking?
The latest article that I have been able to find about Cross-Site cooking was stating that it was possible to set cookie on 2 dots top level domain such as .co.uk.
The mechanism for preventing ...
- 372
23
votes
4
answers
21k
views
Does a webserver need an antivirus software installed?
In what cases does a webserver need an antivirus software installed?
When it is not required?
If it is required sometimes, what should be considered when choosing the right one to install?
(In my ...
- 2,117
11
votes
2
answers
1k
views
Recently had a virus, can I use backed up files on clean system?
I had to reinstall my OS (windows) recently due to a virus. I backed up my source files onto a flash drive. How can I get to those files without problems? I know flash drives can have nasty things in ...
- 233
36
votes
2
answers
8k
views
How can a Software application defend against DoS or DDoS?
Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
- 2,237
11
votes
4
answers
517
views
Defending site against being abused by phishing
Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to ...
- 1,870
25
votes
3
answers
9k
views
What steps should be taken to validate user uploaded images within an application?
Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure ...
- 9,427
15
votes
13
answers
75k
views
How can I intercept and modify HTTP requests?
Are there any free tools available that let me intercept and modify HTTP requests for testing?
I am looking for tools which allow me to send custom HTTP headers.
- 1,883
34
votes
8
answers
6k
views
When a sysadmin leaves what extra precautions need to be taken?
If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials?
Obviously there is also the standard ...
- 729
22
votes
3
answers
883
views
Startup security
I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time ...
AviD♦
- 72.7k
19
votes
6
answers
6k
views
Automated tools vs. Manual reviews
What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages?
This applies both to external blackbox vulnerability scanning, and to static code analysis.
...
AviD♦
- 72.7k
22
votes
3
answers
6k
views
White-box vs. Black-box
What are the relative advantages and disadvantages of each form of testing?
I.e. What is the difference between static code analysis and runtime/dynamic penetration testing?
What are the pros and cons ...
AviD♦
- 72.7k
14
votes
4
answers
291
views
Is external vuln scanning sufficient?
Is running an automated application vulnerability scanner sufficient to certify our application is secure? Why isn't it?
From the original Area51 proposal.
AviD♦
- 72.7k
931
votes
11
answers
312k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 72.7k
11
votes
2
answers
2k
views
Online SQL Server database for a Business app. Security considerations
A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...
- 2,117
36
votes
11
answers
13k
views
Vulnerable OS's?
Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
- 3,342
11
votes
5
answers
2k
views
Encrypting a disk that has stuff on it?
Ok, so a pretty big disk ~1-2TB (90% full, multiple partitions + 2 operating systems on it), needs to be encrypted and zeroed-out, and it's a bit too much data for backing it all up before encryption. ...
- 3,342
9
votes
7
answers
3k
views
If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?
According to Mandiant, you should not:
Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole”
... as described here: http://blog.mandiant.com/archives/1525
...
- 13.8k
9
votes
5
answers
3k
views
Creating tunnel with most ports closed?
How can I create a proxy tunnel from a network that has all ports but port 80 closed? I guess I'd have to bind SSH on my server to port 80, but would that introduce problems to my home network since ...
- 3,342
50
votes
5
answers
10k
views
New XSS cheatsheet? [closed]
There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).
Is there any other list as good as this, ...
- 1,115
13
votes
3
answers
2k
views
How do you defend specifically against attackers utilizing any or all of the commercial exploit kits?
There are several commercial exploit kits available containing 0day vulnerabilities:
White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml
Agora Exploit Pack http:...
- 13.8k
35
votes
5
answers
42k
views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
- 1,115
20
votes
4
answers
4k
views
What type of content better not to transfer by email?
Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure?
I have always wondered how sensible it is ...
- 2,117
16
votes
6
answers
3k
views
What are a few good lists of threats to use to kick-off conversations with others about what worries them?
To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...
- 13.8k
24
votes
4
answers
2k
views
How does using OpenID affect webapp security?
Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use.
But what are the security considerations one should bear in mind when deciding whether to ...
- 2,117
5
votes
2
answers
4k
views
Do you know any crawler/spider software, which is able to go through an ASP.NET site?
Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event?
If ...
- 1,870
14
votes
5
answers
12k
views
What is the right way of storing database connection strings from the security point of view?
What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
- 2,117
13
votes
4
answers
3k
views
What kinds of SSL certificates are usable for encryption?
I know that Verizon SSL certificates cost close to $600.
There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
- 713
62
votes
12
answers
48k
views
How long should the maximum password length be?
The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
- 1,404
30
votes
8
answers
19k
views
Do secure phone lines exist?
I could be out of context here about security, but , I would like to know if phone lines or phone calls over VOIP could be made secure .
I know that Skype and other VOIP service providers have to ...
- 713