37

To summarize: It may work, or not, depending on how the server manages its cache for session parameters. The RFC are not consistent. It is not a "real" vulnerability. TLS sessions were initially meant to be an optimization, to avoid client and server doing the full handshake with its "heavy asymmetric crypto" for each connection (the actual cost of such ...


32

As pointed out in this (unanswered) question, Availability in CVSSv3 is about how well the web service performs, not whether its data is available: While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the impacted component, this metric refers to the loss of ...


25

It depends on whether you are talking about the concepts, the terminology, or the acronym. Concepts of confidentiality, integrity and availability of information have been used by war generals for quite some time; for instance, one can see Julius Caesar operating along these lines during the Gallic Wars and he was certainly not the first to grasp the ...


13

The paper On the Security of the TLS Protocol suggests HTTPS provides availability No, it doesn't. Quote of the relevant section of the paper: II. Security Goals ... The primary goal of TLS, defined in its specification, is “Cryptographic security” [3]. This goal already refers to the Confidentiality corner of the CIA triad. The CIA triad ...


12

If you've empirically verified that it functions as proposed* then you should notify the OpenSSL security team. The impact of this bug would potentially be on the Denial-of-Service spectrum; basically, you can force a client/server pair to perform full negotiations each time, which takes up more server resources (...which is why resumption exists in the ...


12

I would say it presents a clear Availability issue as the attacker is able to completely remove that specific resource and prevent other users' ability to access. I would also say there is an Integrity issue too. The calculator defines a low score on integrity as "modification of data is possible" which I would say is certainly the case here. To answer ...


8

As a physician, even though I can think of situations where having immediate, unrestricted access to clinical information can be critical, I can't think of an "emergency break glass" feature as an absolute requirement for an electronic healthcare information system. The security risks of having unrestricted access are too high, and besides, think of the ...


8

CIA are the aspects of a system that information security strives to protect. Authentication and authorization (important and distinct concepts) are security controls that are used to protect the system with regard to the CIA properties. For example, authenticating a user and checking that they are authorized to access the data ensures the confidentiality ...


7

Personally, I always think of a "break glass" setup when considering the use of data in an emergency setting. Take an emergency room for example: in my mind, all ER doctors should be able to pull all records from the ER terminals. You handle issues by means of exception logging. If a patient's record is accessed without a check-in, then you can investigate ...


6

I think your requirements conflict - plausible deniability is not something which you will get from keyfile backups. But for the backup/availability, follow standard backup and availability practices - mirror to secure location, secure backup, test backups regularly...


6

Operation Technology, Industrial Control systems (ICS and SCADA), medical devices, embedded devices, and specialized communications systems can be frighteningly fragile, especially considering the degree of trust that is placed in them and the serious consequences that follow when they are brought down. Nmap and other non-standard network software can cause ...


6

"Only available to certain users" is not a measure of "availability". That's "confidentiality". Making sure that information is available to users who need it is a measure of "availability". Redundancy, backups, load balancing, parallelism are technical controls that address availability. Access control and encryption do not affect availability but affect ...


5

Rent a safety deposit box at your bank. Deposit one or two copies of the keyfile on different media such as optical and USB (redundancy in case of media-specific bit rot). Alternatively (or in addition), take the keyfile data, base64 encode it with a simple check per line (sum mod 7 or similar check digit) and print it out on a piece of paper. It doesn't ...


4

Most banks provide safety deposit boxes, and my bank gave me one for free. Their smallest box isn't quite big enough for a normal 5.25" hard drive but its large enough to fit a few hundred GB in USB sticks or maybe a laptop drive. I make a copy of all of my key files as well as other important information and store it in this box in an encrypted archive. ...


4

Steganographically encode the keyfile into pictures you take. Explains why you have multiple copies, as you can explain that you don't want to lose them. Make sure no copies exist without the keyfile encoded, as the difference in the pictures can be used to crack the steganography.


4

In this case, I wouldn't try to roll my own solution per platform, since there are tools designed specifically to manage team access to social media accounts. HootSuite, for instance, has a number of team management features. All you have to do at that point is manage access to HootSuite, not Twitter and FaceBook and anywhere else you might have accounts. ...


4

INTEGRITY After deletion, the resulting dataset will assert that no such comment was ever left. That assertion is in error.


4

The real risk here would be the application importing the .ics file, the file in itself is harmless. Only if that application would improperly handle parts of the file content you would be at risk. With Google Calendar, I think those chances are very, very slim.


3

All models are, by definition, simplistic in some way; they are models. That's their job. At some point, someone coined the triad "confidentiality, integrity, authenticity" (I don't know who, but it is old). This is a mental framework: every information security concept can be forced into one of these three categories, sometimes with the help of the ...


3

I would recommend having a single user entitled to do the actual posting, and serving as proxy for all others. This allows him to avoid collisions (two of the posters posting the same thing almost simultaneously). To prepare for the untimely demise of that specific user, a backup of passwords is kept in a safe place (preferably, in a safe). A secret which ...


3

If I read the paper correctly, availability in this context just means that TLS does not have any intrinsic properties which limit the availability. It does not mean that using TLS by its own increases the availability because TLS just provides secure transport. Of course, practical use of TLS might both increase and decrease availability. Increased ...


3

When you look at something from a security perspective, its security aspects emerge. That often refers to the security-related principles and concepts which are part of a particular technology. (This technology doesn't have to be about security itself.) Examples: Anonymity is an important security aspect of wireless communications and has continuously ...


3

Assuming absolutely no quotas are enabled, not even the default ones in many filesystems that give root a little more free space than other users, a malicious process could write to the disk until it is completely full. This would prevent any other program, even privileged daemons, from writing to the disk. This could lead to a denial-of-service condition ...


2

This mechanism is now made mandatory by law in France (lookup PGSSI-S, in French). I don't know about other states, but you should check the relevant legislation.


2

Some automatic blood bank audit and release systems have a 'break glass' feature where the fridge can be accessed without having to follow the normal process, which might be; input request, scan patient record identifier, bidirectional interface with lab system looks up blood type and the blood unit is scanned on removal from the fridge... It's very useful ...


Only top voted, non community-wiki answers of a minimum length are eligible