All Questions

Filter by
Sorted by
Tagged with
25 votes
8 answers
33k views

Can I detect web app attacks by viewing my Apache log file? [closed]

I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
Tate Hansen's user avatar
  • 13.8k
8 votes
3 answers
2k views

How to determine whether site is secure from common user's point of view?

What should be done (or at least declared) so end-users, visitors will start trusting your website? Some thoughts: secured login (via https) privacy policy (hidden email and other private ...
garik's user avatar
  • 1,292
80 votes
5 answers
37k views

What techniques do advanced firewalls use to protect againt DoS/DDoS?

It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
Jonas's user avatar
  • 5,193
14 votes
2 answers
2k views

What is the best way to verify the SSL configuration of my web server?

How do I ensure I have my SSL configuration setup securely?
Tate Hansen's user avatar
  • 13.8k
12 votes
3 answers
2k views

What are the pros/cons of using a threat detection system?

What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)? What does a properly implemented threat detection system do and how does it behave when it detects ...
VirtuosiMedia's user avatar
22 votes
1 answer
3k views

Is it secure to connect to a remote Windows Server using Remote Desktop only?

I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
Jonas's user avatar
  • 5,193
51 votes
3 answers
114k views

How can I check that my cookies are only sent over encrypted https and not http?

I read a blog post GitHub moves to SSL, but remains Firesheepable that claimed that cookies can be sent unencrypted over http even if the site is only using https. They write that a cookie should be ...
Jonas's user avatar
  • 5,193
16 votes
8 answers
3k views

Password management/synchronization?

Is there a good enough service I could run on my own home (Linux) server that I could use for storing/accessing/synchronizing passwords so they could be available for me from multiple computers/places?...
tkit's user avatar
  • 3,352
19 votes
5 answers
3k views

Is Google Chrome a more secure browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast at Pwn2Own 2010. Is Chrome really so good or was it not tested? Has anyone other results of independent investigations about security of ...
garik's user avatar
  • 1,292
29 votes
5 answers
6k views

Professional certifications for IT Security [closed]

Which credentials of the sub-list of IT certifications (as per the Information Systems Security Association) would be considered MUST HAVE for a IT Security specialist? CEH Certified Ethical Hacker ...
Eric Warriner's user avatar
35 votes
6 answers
10k views

Does it matter which Certificate Authority I source my SSL Certificate from?

To secure my web site with HTTPS, does it matter which company I source my SSL certificate from, or just that the browser recognizes it? From the Area51 proposal.
AviD's user avatar
  • 73.3k
55 votes
9 answers
58k views

Feeding /dev/random entropy pool?

Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
tkit's user avatar
  • 3,352
26 votes
9 answers
29k views

What cryptographic algorithms are not considered secure? [closed]

What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
Olivier Lalonde's user avatar
106 votes
11 answers
32k views

Best practices for Apache Server hardening?

What are some best practices, recommendations, required reading for securing an Apache Server?
Eric Warriner's user avatar
23 votes
5 answers
5k views

What are the best practices for mitigating zero day attacks?

What are best practices / recommendations / strategies for mitigating zero day threats/attacks from a software development perspective?
Eric Warriner's user avatar
13 votes
7 answers
3k views

Is an IP address blacklist good practice to prevent website attacks?

My website has a blacklist of IP addresses. The web application, in some way, detects all invalid, suspicious influences to it and remembers IP address and denies any requests from that IP address. ...
garik's user avatar
  • 1,292
21 votes
4 answers
5k views

How to keep a shared web hosting server secure?

What are the ways of keeping a shared LAMP server secure, assuming SSH access is available for every user? Edit: I am mainly thinking of securing the server from the users themselves and between ...
Olivier Lalonde's user avatar
79 votes
6 answers
16k views

How to disclose a security vulnerability in an ethical fashion?

How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
Olivier Lalonde's user avatar
23 votes
5 answers
3k views

What is the best option for setting up a several sites supporting SSL on the same IP?

If multiple hostnames are hosted on the same IP, it's not straight forward to allow them to support https. What are the best options in terms of browser support and/or web server support?
Erlend's user avatar
  • 2,245
66 votes
6 answers
35k views

How to Securely Implement a "Remember Me" Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
colithium's user avatar
  • 873
24 votes
5 answers
3k views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
James T's user avatar
  • 1,883
46 votes
8 answers
6k views

What methods are available for securing SSH? [closed]

What methods are available for securing SSH?
Olivier Lalonde's user avatar
22 votes
7 answers
2k views

Computer Forensics: what is in your toolbox?

What tools do you use for collecting evidence, making disk images, inspecting live memory and so on?
gbr's user avatar
  • 2,020
63 votes
16 answers
57k views

What tools are available to assess the security of a web application?

What tools are available to assess the security of a web application? Please provide a small description of what the tool does. Update: More specifically, I'm looking for tools that assume no ...
Olivier Lalonde's user avatar
16 votes
3 answers
3k views

ASP.NET MVC Security Check List

I am planning to start a new web site on ASP.NET MVC 2 (3). Does anybody have a full (if possible) check list of actions or approaches I should go through to avoid most security issues?
garik's user avatar
  • 1,292
24 votes
4 answers
6k views

Should I use Suhosin for PHP?

Suhosin can be used to increase the security of your PHP application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps there. ...
Peter Smit's user avatar
  • 2,759
23 votes
4 answers
28k views

Which web server is more secure, Apache, nginx or lighttpd?

We are trying to decide which web server to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
Peter Smit's user avatar
  • 2,759
47 votes
5 answers
11k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
VirtuosiMedia's user avatar
29 votes
5 answers
2k views

Is filtering of user input data enough, or should it be parsed?

In a web application there could be two approaches to mitigate XSS attacks: all the input data could be filtered (removing all 'bad' data), or the input could be parsed, tokenized and output with ...
Peter Smit's user avatar
  • 2,759
117 votes
18 answers
20k views

Does an established HTTPS connection mean a line is really secure?

From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
Peter Smit's user avatar
  • 2,759
23 votes
2 answers
4k views

Rails - protection against code injection and XSS

I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS? I know Rails tries to prevent ...
Magnus's user avatar
  • 1,204
30 votes
14 answers
4k views

Courses on "Secure Software Development" [closed]

This semester, I'm offering a course on "secure software development". The course is divided into three parts: Secure Software Engineering Reverse Engineering Secure Coding Do you know of any ...
Sadeq Dousti's user avatar
  • 1,514
12 votes
3 answers
814 views

Are bookmarklets safe with facebook data?

I usually play Mafia Wars and use bookmarklets like Spockholm, Arum, etc. Can these bookmarklets get my Facebook data when I run them, they usually ask to unframe the Facebook page? I was just ...
Nap's user avatar
  • 275
667 votes
4 answers
331k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
Sam Saffron's user avatar
  • 6,755
26 votes
6 answers
9k views

Does prepending a salt to the password instead of inserting it in the middle decrease security?

I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
Arseni Mourzenko's user avatar
13 votes
4 answers
1k views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks: Is the presence of wireless access points tested for by using a wireless analyzer at ...
user avatar

15 30 50 per page
1
1372 1373 1374 1375
1376