259
votes
Accepted
Do I need to encrypt connections inside a corporate network?
Yes encrypt, it is easy. Plus according to a 2014 Software Engineering Institute study 1 in 4 hacks was from someone inside the company with an average damage 50% higher than an external threat actor. ...
- 3,012
110
votes
Do I need to encrypt connections inside a corporate network?
What are the real world chances that someone would steal his identity?
Running a MITM attack on an HTTP connection when on the same LAN is basically trivial. ARP is not designed to be secure. Some ...
- 3,299
82
votes
Unexpected email from Yorkshire Bank
I feel that ignoring would be the wrong thing to do, but I'm not sure what to do.
If you feel that ignoring this is wrong, look up the bank's phone number from a reputable source, e.g. yellow pages ...
- 17.6k
56
votes
Accepted
Another domain is using our web app's IP address. How to prevent it?
Our web application is being mimicked by another domain ...
The domain in question is configured to resolve to the same IP address as yours. That's why it looks like they mimic you when in fact it is ...
- 208k
47
votes
How to be mean to some people that stole my phone
Offensive defense is the type of attack you are looking to perform. You have been the victim of a technological crime, you are the target of a phishing campaign, and you want to get even. This is a ...
- 1,451
41
votes
Do I need to encrypt connections inside a corporate network?
Yes, you have to encrypt your connections. Let's take a scenario where you believe your network is physically secured (with required physical security and other required security measure) and no ...
- 2,037
29
votes
Do I need to encrypt connections inside a corporate network?
Risk of Repudiation
In addition to all the fine answers about employees as a threat and visitors as a threat, I think you have to consider that the mere fact that the traffic is unencrypted is of ...
- 467
27
votes
How to be mean to some people that stole my phone
I've just checked on Whois.us. Both domains are registered to the same person, with a stated address in London.
Try talking to the internet fraud team from your local police. Chances are they're ...
- 845
26
votes
Another domain is using our web app's IP address. How to prevent it?
Is your site nrnsewa.com? If so, you aren't being mimicked, they just entered the IP address of your server in the DNS entry for their domain name. As a result, https://www.djjpl.com.sg is hitting ...
- 2,621
21
votes
Accepted
Is the image of the signature considered PII?
PII by definition is
any information that can be used on its own or with other information
to identify, contact, or locate a single person, or to identify an
individual in context.
And to ...
- 3,951
21
votes
Risks of exposing professional email accounts?
The security problem would be that you become a database of contact info. You have described few controls and no need for users to provide their personal details and contact info.
Marketers would ...
- 132k
14
votes
Accepted
Help! My information has been stolen! What do I do now?
How secure are my auto-saved passwords in my browser?
Terribly insecure. These passwords are trivial to retrieve.
How secure are my passwords that have been saved in a password manager?
Not very ...
- 21.6k
14
votes
Do I need to encrypt connections inside a corporate network?
Some companies, especially larger ones that have been around long enough to develop bad habits, have roughly the following fallacious security model:
The network is safe as long as nobody else ...
- 13.2k
14
votes
Do I need to encrypt connections inside a corporate network?
In 2018, the answer depends on your threat and risk analysis results. Which, of course, you have performed, identified the likely scenarios, rated them and made a business decision based on the impact ...
- 10.7k
14
votes
How to be mean to some people that stole my phone
Call the police and sue them in court! That will show them you can be mean. Moreover, it will be legal and you will stay out of trouble.
- 10.7k
14
votes
How to be mean to some people that stole my phone
The attackers are skilled enough to not enable the phone and to set up a fake Find My iPhone site. This clearly shows they understand fairly well how the iPhones security features work and are trying ...
- 10.7k
14
votes
I entered my password in a possible scam website. What should I do?
You should change the password at all the places where you have used it.
Some Additional tips:
Use a password manager.
Use two factor authentication in every possible places.
Never reuse passwords.
- 1,019
14
votes
Unexpected email from Yorkshire Bank
The other answer addresses the rest of your question so I will focus on this part:
My main concern is that my identity has been stolen for the purpose of
procuring Yorkshire Bank products, such ...
- 2,091
12
votes
Unexpected email from Yorkshire Bank
I have a very generic e-mail address on which I receive similar e-mails from a Finnish and a French bank (I am not Finnish nor French and don't have any bank contacts in either country).
However, I ...
- 499
9
votes
Accepted
Why would a stranger keep signing up to trading sites with my email address?
I have 4 different people who regularly use my email address to sign up for things. I get incorrectly addressed emails daily. After a few years of getting their emails, I know just about everything ...
- 132k
9
votes
Do I need to encrypt connections inside a corporate network?
Yes, you do need to encrypt inside your "secure" corp network.
Any network penetration will lead to snooping traffic, and anything not encrypted is easy pickings for the attacker. Credentials, ...
- 1,962
9
votes
Risks of exposing professional email accounts?
You don't have a product
All you have is a database of email addresses. That's an asset, not a product. A product needs to do something with those email addresses.
Who would want to get access to ...
- 845
7
votes
Do I need to encrypt connections inside a corporate network?
Yes. You should always encrypt connections on any intranet, just as you would on the public internet.
The DNS Rebinding attack publicized yesterday allows an attacker full access to any HTTP resource ...
- 71
7
votes
Do I need to encrypt connections inside a corporate network?
Defense in depth
There are several good answers here, but even if you trust all your employees completely (which you most likely should not), you open the door for an external attacker and make ...
- 1,511
7
votes
Risks of exposing professional email accounts?
Basically, since the sign-up to your service on ones free will, it is rather a privacy related topic (assuming it's security wise at the state of the art and well maintained).
A leaked email alone is ...
6
votes
Is the image of the signature considered PII?
Yes, it is.
Some people have well-readable signatures (sometimes even OCR-readable), so an image of the signature is equivalent to the full name of the person who made it.
People who have unreadable ...
- 49.6k
6
votes
Accepted
Is a company's dark web search really effective at proving my info is not there?
This borders on being a scam. The "dark web" does not contain what people think it does, and it is not vast or all-encompassing. Hackers do not just randomly put stolen information on the dark web, ...
- 67.3k
5
votes
Is it dangerous for a scammer to know just your name and birthday?
It depends on what other information they have. If it was in fact a scammer, they may have had other information but needed your birthday to make use of it. In that case, you'd have an imminent risk ...
- 42.2k
5
votes
Implications of prominent *secure messaging apps* requiring phone number identifiers
Not having a phone number tied to you wouldn't really stop intelligence agencies from associating you with who you're talking with.
Encryption ensures they can't track what you're talking about, but ...
- 31.6k
5
votes
Accepted
Someone has registered my partner's recycled email account
Why would someone do this and what can she do to protect herself?
It is not clear what the motive could be. Maybe someone is recycling old, forgotten, deprecated accounts to sit and wait for an ...
- 1,366
Only top scored, non community-wiki answers of a minimum length are eligible