12

You put in the DMZ the servers which must be accessed from the outside. Since they are reachable from the external World (which is assumed hostile), these servers are potentially subject to hijack by attackers. The DMZ is a containment area so that a subverted server does not gain immediate access to your most valuable data (which will be presumably kept in ...


8

The recent compression-related attacks all work on the same principle: some chunk of bytes is compressed, containing both a data element that the attacker chooses, and a data element that the attacker wants to uncover. The resulting compressed length is used as a binary oracle in successive "guesses" from the attacker, who progressively rebuilds the secret ...


8

I've been supporting and administering email for 18 years, and never had a valid reason to block text attachments. Here are some issues that I can think of, that aren't exclusive to TXT attachments alone, but rather regard attachments in general Unicode parsing The only two issues I've come across is this unicode bug but it's theoretically possible that ...


8

As luck would have it, Microsoft has documented this. The answer to your question is yes. They use TLS 1.2 between any Office 365 groups, and they also use it opportunistically for external destinations, so as long as the recipient's server supports it, that message path will also be encrypted. https://technet.microsoft.com/en-us/library/mt163898.aspx and ...


6

I have done this in the past by: Renaming "Director A" to "Director A (Private)" Creating a Distribution Group called "Director A" that contains "Director A (Private)" and "PA A" giving the PA delegate permissions so he can access the "Director A (Private)" calendar and to send mail on behalf of the "Director A" group, but not permission to access the "...


6

Unless there is some special configuration I'm not familiar with: Joe user. There is an Edit function, hiding right there under Other Actions (in Outlook 2007, at least...). Note you can only see this when you open it in full message view, and not in the preview pane (as I usually read it...). Note also that this is not available via OWA. It may be ...


5

The 'Clear SSL State' button is there to purge the SSL cache of selected Client Certificates used for authenticating to SSL-based services. It's just there to make client-certificates work faster (partly by remembering which certificate you used to authenticate to a certain site). It doesn't cache previously seen SSL certificates. Outlook+Exchange can use ...


4

This setup does not provide non-repudiation. Non-repudiation is very challenging to achieve, and based on what I am hearing, you are nowhere near it. Based on your description, you're not going to be able to prove the validity of the emails through technical arguments alone. You will have to use non-technical arguments. You might find other witnesses to ...


4

Normally, SSL management is per process. The SSL implementation DLL will, for instance, remember SSL sessions and be able to negotiate abbreviated handshakes (that's when a client reconnects to a server, and they agree to reuse the symmetric shared secret they established in a previous connection). Internet Explorer now has the habit of spawning several ...


4

If your intrusion detection system sees anything worth reporting while looking at a SSL connection, then it is not SSL, or is very poorly implemented. By construction, SSL is meant to provide a tunnel for confidential data, i.e. it is very opaque from the outside. Generally speaking, SSL is not a threat, it is a protection measure against threats. In ...


4

There is no reason to give your employee local admin rights on their computer, there is the principle of least privilege, please look it up and implement it. Giving everyone admin rights is a big no-no and can be even more dangerous when it comes to data leakage as successful attacks to your employee's their computer can now also result in exposure of your ...


4

What you are looking for is theoretically viable, provided that you add the missing extra piece, i.e. some form of time stamping. However, behaviour of existing, deployed implementations is likely to be a problem. The conceptual idea is that if you verify a signature at date T on some message, then, at a later date T', you can still remember that the ...


3

The Exchange ActiveSync Policy Engine gives administrators the option to allow biometrics. See http://technet.microsoft.com/en-us/library/dn282287.aspx for details. In addition, it seems almost certain that using a PIN code or passphrase instead of biometrics will remain an option. It turns out that you must set at least a PIN when using TouchID. When you ...


3

Well it would be an ugly hack, but you could set up a secondary email account called somthing like "Director-A-Private" which would be used for the private communications. Both outlook and the iPads support multiple accounts so it would work from that perspective. The key stumbling block would be the usuability (i.e. will they pick the right from address ...


3

One of the problems with unsupported software is that you simply don't know. Not only there is nobody to fix security bugs, but there's usually nobody to even collect and disseminate vulnerability reports. The problem becomes much worse with closed-source software. I think it would be difficult to find issues, let alone create and distribute unofficial ...


3

You'd have to consider the benefits to your approach as well as drawbacks and compare it with other alternatives to make an informed decision. a few pointers: Who is managing those public folders / exchange? Those users might not need to have access to those settings/accounts, but since it's their job to manage the exchange server, they now also have ...


3

I am sorry but I cannot speak for Android Wear, I don't know their technical infrastructure. I know a lot about the Apple Watch. So: Do either Apple Watches or Android Wear have local storage, or cache data from the connected phone? Yes, the Apple Watch has 8 gig of internal storage and yes they cache the last data you received on each indiviual app (...


3

In the United States, generally anyone can subpoena anyone or anything as part of the "discovery" process. It is up to the presiding Judge to decide whether or not this is relevant or allowable. In a civil action, as opposed to a criminal one; some typical protections (e.g. 5th amendment protection against self-incrimination) do not apply. Thus, it is far ...


3

Protocol versions matter, even given the same cipher suite, because the suite specifies the primitives but not necessarily how they are to be used. For example, the critical difference between SSLv3 and TLS1.0 that makes the former vulnerable to POODLE is that TLS mandates validation of the padding, and SSLv3 does not. TLS 1.1 requires an explicit ...


3

No it is not. You have at least 5 parties at play here, the sender S and their email server T, the recipient R and their email server Q, and an attacker. While TLS does use encryption, the purpose of 'encrypting email' is to prevent anyone but the recipient from reading the message. TLS only protects the message from prying eyes in 2 cases: Case 1: between ...


3

Public Key Cryptography has two basic primitives - Encryption - data encoded using the Public Key can only be read using the Private Key Signing - data that can be decoded using the Public Key must have been written using the Private Key As you can see, these are really just two sides of the same coin, both depending on the Private Key being Private and ...


2

I would look on MsDN and support.microsoft.com for any IIS vulnerabilities first since IIS is usually the target du jour for hackers. Then look for the PS module specifics to check if they are screwed up after a recent update or something esoteric -- I would be wary of Unicode and any of the larger character sets -- have him point you to the KB ...


2

I don't think there is a simple answer for this: your security demands may vary. If you fear keyloggers stealing your passwords, giving adversaries access to confidential email, then by all means use 2-factor authorization (among other techniques). However, if you only anticipate receiving relatively mundane emails then there isn't a need for it, and ...


2

Try to block the IP at firewall level, use DROP not REJECT. Monitor, if he does it again, add that IP too. They are probably scanning for an open relay or a way to use your mailserver as a relay for spam. Don't panic because these scans are quite common. You can try to look for IDS solutions to automatically block this behavior if it bothers you too much. ...


2

Firstly, I am interpreting your question to mean that end-users will not be using digital signatures. They can't be bothered, etc. I do answer this with the use of non-interactive signatures on the server that the end-user would never see or be affected by. Question 1: ... how easy is it for suspect employees to alter un-signed e-mail evidence... in their ...


2

The Surface Pro runs Windows 8 Pro and has a TPM, so in theory at least, you should have all the available security features of any Windows 8 laptop, including BitLocker.


2

My (wild) guess is that the "hashcode" is just a reference key used by whatever system enforces the throttling, to quickly locate in an internal database (which could be an in-RAM hash table) the entry which keeps track of the "budget" allocated to each entity. Thus not a cryptographic hash at all.


2

Generally the idea is to determine what hardware you trust and what hardware you don't. Things that are highly exposed and don't contain sensitive data don't need to be trusted and can then live outside. If a web server's sensitive data is provided by a DB, then the web server itself can be relatively untrusted, but this breaks down in a lot of cases such ...


Only top voted, non community-wiki answers of a minimum length are eligible