13

You put in the DMZ the servers which must be accessed from the outside. Since they are reachable from the external World (which is assumed hostile), these servers are potentially subject to hijack by attackers. The DMZ is a containment area so that a subverted server does not gain immediate access to your most valuable data (which will be presumably kept in ...


8

I've been supporting and administering email for 18 years, and never had a valid reason to block text attachments. Here are some issues that I can think of, that aren't exclusive to TXT attachments alone, but rather regard attachments in general Unicode parsing The only two issues I've come across is this unicode bug but it's theoretically possible that ...


8

The recent compression-related attacks all work on the same principle: some chunk of bytes is compressed, containing both a data element that the attacker chooses, and a data element that the attacker wants to uncover. The resulting compressed length is used as a binary oracle in successive "guesses" from the attacker, who progressively rebuilds the secret ...


8

As luck would have it, Microsoft has documented this. The answer to your question is yes. They use TLS 1.2 between any Office 365 groups, and they also use it opportunistically for external destinations, so as long as the recipient's server supports it, that message path will also be encrypted. https://technet.microsoft.com/en-us/library/mt163898.aspx and ...


6

I have done this in the past by: Renaming "Director A" to "Director A (Private)" Creating a Distribution Group called "Director A" that contains "Director A (Private)" and "PA A" giving the PA delegate permissions so he can access the "Director A (Private)" calendar and to send mail on behalf of the "Director A" group, but not permission to access the "...


5

The 'Clear SSL State' button is there to purge the SSL cache of selected Client Certificates used for authenticating to SSL-based services. It's just there to make client-certificates work faster (partly by remembering which certificate you used to authenticate to a certain site). It doesn't cache previously seen SSL certificates. Outlook+Exchange can use ...


4

If your intrusion detection system sees anything worth reporting while looking at a SSL connection, then it is not SSL, or is very poorly implemented. By construction, SSL is meant to provide a tunnel for confidential data, i.e. it is very opaque from the outside. Generally speaking, SSL is not a threat, it is a protection measure against threats. In ...


4

Normally, SSL management is per process. The SSL implementation DLL will, for instance, remember SSL sessions and be able to negotiate abbreviated handshakes (that's when a client reconnects to a server, and they agree to reuse the symmetric shared secret they established in a previous connection). Internet Explorer now has the habit of spawning several ...


4

What you are looking for is theoretically viable, provided that you add the missing extra piece, i.e. some form of time stamping. However, behaviour of existing, deployed implementations is likely to be a problem. The conceptual idea is that if you verify a signature at date T on some message, then, at a later date T', you can still remember that the ...


4

In my professional experience, this is not a common step from "hackers". However, I don't have any hard numbers to back that up, so I wouldn't take that statement as anything more than anecdotal evidence. However, it's worth stating the obvious about why the hacker did this. What it really comes down to is that the attacker used this, effectively,...


3

In the United States, generally anyone can subpoena anyone or anything as part of the "discovery" process. It is up to the presiding Judge to decide whether or not this is relevant or allowable. In a civil action, as opposed to a criminal one; some typical protections (e.g. 5th amendment protection against self-incrimination) do not apply. Thus, it is far ...


3

I am sorry but I cannot speak for Android Wear, I don't know their technical infrastructure. I know a lot about the Apple Watch. So: Do either Apple Watches or Android Wear have local storage, or cache data from the connected phone? Yes, the Apple Watch has 8 gig of internal storage and yes they cache the last data you received on each indiviual app (...


3

The Exchange ActiveSync Policy Engine gives administrators the option to allow biometrics. See http://technet.microsoft.com/en-us/library/dn282287.aspx for details. In addition, it seems almost certain that using a PIN code or passphrase instead of biometrics will remain an option. It turns out that you must set at least a PIN when using TouchID. When you ...


3

There is no reason to give your employee local admin rights on their computer, there is the principle of least privilege, please look it up and implement it. Giving everyone admin rights is a big no-no and can be even more dangerous when it comes to data leakage as successful attacks to your employee's their computer can now also result in exposure of your ...


3

Well it would be an ugly hack, but you could set up a secondary email account called somthing like "Director-A-Private" which would be used for the private communications. Both outlook and the iPads support multiple accounts so it would work from that perspective. The key stumbling block would be the usuability (i.e. will they pick the right from address ...


3

Protocol versions matter, even given the same cipher suite, because the suite specifies the primitives but not necessarily how they are to be used. For example, the critical difference between SSLv3 and TLS1.0 that makes the former vulnerable to POODLE is that TLS mandates validation of the padding, and SSLv3 does not. TLS 1.1 requires an explicit ...


3

No it is not. You have at least 5 parties at play here, the sender S and their email server T, the recipient R and their email server Q, and an attacker. While TLS does use encryption, the purpose of 'encrypting email' is to prevent anyone but the recipient from reading the message. TLS only protects the message from prying eyes in 2 cases: Case 1: between ...


3

Public Key Cryptography has two basic primitives - Encryption - data encoded using the Public Key can only be read using the Private Key Signing - data that can be decoded using the Public Key must have been written using the Private Key As you can see, these are really just two sides of the same coin, both depending on the Private Key being Private and ...


3

What can be done depends how much control you have over this IP address. Adding this IP to the SPF record means that any mails originating from this IP address are allowed to use any email address within your domain as sender within the SMTP dialog. If there is only one application which runs there and you trust it this might be fine. If instead you must ...


2

My (wild) guess is that the "hashcode" is just a reference key used by whatever system enforces the throttling, to quickly locate in an internal database (which could be an in-RAM hash table) the entry which keeps track of the "budget" allocated to each entity. Thus not a cryptographic hash at all.


2

Generally the idea is to determine what hardware you trust and what hardware you don't. Things that are highly exposed and don't contain sensitive data don't need to be trusted and can then live outside. If a web server's sensitive data is provided by a DB, then the web server itself can be relatively untrusted, but this breaks down in a lot of cases such ...


2

The Surface Pro runs Windows 8 Pro and has a TPM, so in theory at least, you should have all the available security features of any Windows 8 laptop, including BitLocker.


2

The delivery of the Authorization Code is not more a security issue than is sending the user's password from the browser to the facebook server (for example). That means, if there is an insecure connection, an attacker would be able to compromise the user's authentication anyway. For that reason, OAuth is meant to be executed with HTTPS. The reason why it ...


2

In addition to makerofthings7's very thorough answer, another reason could be to prevent phishing attacks which tunnel dangerous content in the TXT attachment. For example, if you send a file called ILOVEYOU.EXE.TXT, sign it as "grandma", and instruct the user to save and rename the file - some percentage of users will happily follow those instructions to ...


2

We have our Exchange server in a remote site administered by an external provider. Another possibility is not using an Exchange server but use some solution in the cloud but in that case it is neccessary to blindly believe the provider when he says that their employees are unable to access the emails... There is no difference in trust between cloud and some ...


2

Not sure if there is a better way, but this is how I would do it. I think it is similar to what you describe in the question. Store the network credentials encrypted with a key that is derived from the users password, e.g. using PBKDF2). (If you also store password hashes for authentication, use a different salt so they are not identical.) That way, if your ...


2

Some usual reasons (not a comprehensive list): Your mail server is an open relay, anybody on the internet can use it to send emails to any address. Spammers very quickly find these and use them to spread spam. This way your server will get blacklisted in RBLs (see below). Your server is used to send spam by its legitimate clients due to malware on your ...


2

The whole idea of BCC is to not disclose any BCC recipients to each other. An email program whose sent mails allow the recovery of BCC recipients is terribly broken. The Exchange Online docs also confirm that they don't intend to forward addresses in BCC: Bcc recipients are stored in the message in the sender’s mailbox, but not included in headers of the ...


Only top voted, non community-wiki answers of a minimum length are eligible