Hot answers tagged

23

The username is not a secret; any determined attacker will be able to find out the names of users on your system. What does improve your security, is if there is no remote access for "root", "guest", and similar account names found on many systems. In fact, Ubuntu explicitly disables the "root" account because it is such a favorite target.


22

Take a passive approach and do a risk assessment. Security management is a form of risk management. You have assets which might have threats and vulnerabilities. A threat exploiting a vulnerability is a risk, which is calculated by calculating (quantitative) or estimating (qualitative) the likelihood and impact (most of the time it's high,medium,low but some ...


15

You will want to be sure that a user's e-mail address is correct if you intend to send mail to it that is either: security-sensitive (eg forgotten password reset token), or recurring/high-quantity, to avoid harassing some other person whose address has been entered. This is typically more about weeding out incorrect addresses that have been entered by ...


15

There are a number of reasons that replying to an email from someone you don't know may be a bad idea in a business context: In some situations you may see a "from" email address that is spoofed, with a different reply email address. In such a situation you may reply to the "from" email address under some assumption of who they are, when in reality you're ...


12

No, you can't. It's as easy as you search information about "DNS leak" topic. When you use a VPN, you have the risk of a DNS leak. In other words, your DNS resolution will be made outside your VPN. Second, VPN server knows (in some way) who you are, where are you from and where you want to go. It's the same risk that exit nodes of Tor Network pose. ...


9

The risk to the recipient is that there could be anything on there. The biggest risk to you is probably reputational damage, as you are just providing empty USB sticks, not delivering them with sensitive information on. I would be surprised if they could hold you liable for loss of their data - I don't know of any cases thus far where this has happened (...


9

There are different ways to deal with this, ranging from questionably ethical but highly effective, down to completely passive. If you really want to show them that physical attacks work, break in during your next pentest. I don't mean "grab a crowbar", but rather walk into the lobby, walk past reception, and walk straight into their offices. If they ...


9

Finding statistics for this is rather difficult, but here are some sources that are close (I say close, because most look at platforms that are often used to distribute pirated software, but also to distribute legal software). The percentage of malware seems to vary greatly based on distribution - eg P2P like Kazaa and Limewire contain more malware than ...


8

As the person who gives the USB keys, your risk is about reputation and possibly legal retaliation; see @Rory's answer. For who receives the key, risks are higher, in particular because what looks like a conventional USB key may declare itself, at the USB level, to be a keyboard, and begin to automatically "type" things wildly. It has been demonstrated. ...


8

You shouldn't trust them. You may suffer from "DNS Leaking". Ideally, your computer should send DNS Requests through the VPN, but it may request it directly. Your IP address will be exposed. Anyone snooping on the connection to the DNS Server will see what site you are accessing. That also opens you up to the dangerous Man-In-The-Middle attack. Use DNSCrypt ...


7

If you plan on sending email to that address then you need to verify to avoid being identified as a spammer. If you ask the user to agree to a contract and you can't verify identity based on some other information like a CC#, then you need to verify. If not, then if you ever need to go to court for breach of contract, you have no evidence that the person ...


7

A CSRF attack tries to exploit "the trust that a site has in a user's browser" (so says the Wikipedia page, and it is well said). It is about the server accepting a request from the client, on virtue of the request coming with some authentication characteristic which makes the server believe that it comes from the genuine user (which it does) and under the ...


7

Major Caveat upfront: It is possible to be insecure in any language, any time, and only developer attentiveness/awareness can fix this. SQL injection is still a thing. Higher-level languages generally have eval, and if you're dumb enough to eval user input you get what you get. That being said, its the other way around. Having garbage collection avoids ...


6

What is the implication of verifying it? The referer header: can be spoofed by the client can be completely omitted by the client (notoriously when going through TOR/proxies) is no guarantee that the user actually came from there There referer header is sent as a courtesy from your browser, it is not a HTTP RFC requirement. See here for details on the ...


6

There is not government organization overseeing information security. What we have are sets of standards such as PCI or laws like Sarbanes Oxley and HIPPA. When a company wants to do business with MasterCard or Visa they will (usually) be required to be PCI compliant and have an audit done before they can do business. If your business depends on ...


6

Suppose that you have a pseudorandom function with an output of n bits. A good hash function with a given salt ought to behave like a PRF. The general, average structure of a PRF, with regards to repeated application, is to have one big "cycle": if you hash and rehash repeatedly, you will, at some point, enter a cycle and obtain a value which you already ...


6

The impact may change if the control put in place alters a potential attacker's abilities should the problem be exploited. A good example of where the impact would change is when the mitigation involves segregating networks. Before the segregation, an exploit on OldCorp Unsupported Legacy Daemon X might lead to someone getting access to the internal network,...


6

generally Nessus severity ratings will line up to the brackets outlined here for CVSS Score --> severity mappping so NVD Vulnerability Severity Ratings NVD provides severity rankings of "Low," "Medium," and "High" in addition to the numeric CVSS scores but these qualitative rankings are simply mapped from the numeric CVSS base scores: ...


6

one-letter is indeed a bit short, but a good IDS can quickly see if someone is messing with your network if 3 letter usernames are being used. But from a security standpoint one should assume the Username is known to an attacker since its often easy to guess or not protected at all (leaked at some other place) so short usernames are not so much an issue, ...


6

There are lots of other possibilities. Note that the CIA triad is not so much a model for security risks as it is for security goals/objectives. It has often been criticized for being overly simplistic and incomplete. Consequently, there are lots of alternative models and extensions of the CIA triad. One popular option is the Parkerian hexad that consists ...


5

USB flash drives are an extraordinarily bad promotional item. Because of the frequent malware, most companies now have rules forbidding employees from accepting them, or to destroy them if they already have. Remember that malware comes in many forms on such drives. The latest to appear is where hackers reprogram the firmware on the devices, such that they ...


5

There is no such control. You could further argue that if such control existed, it would almost certainly fail. Certain industries have their own regulation; for example there's HIPAA for health care, SOX for publicly traded companies, and a whole panoply of regulation for defense and federal contractors. Most of these rules have nothing to do with IT ...


5

The short answer is that I don't believe you can. One input field on one page may be far more important than 100 on another for example. The issue is that you cannot assess risk without access to more information. Risk is calculated by the ease and likelihood of a vulnerability being exploited multiplied by the damage that would be inflicted by its ...


5

The "by the book" approach to this is to use a key-stretching/key-derivation-function to turn a one secret into another (longer) secret. Or two or more secrets. One for HMAC, one AES session key, etc. This is what TLS does. It expands the master secret into a block of six single other secrets. I can not name a practical attack if you don't do that. But ...


5

There are really two things you need to trust here: the DNS response's authenticity and privacy. Authenticity You can be reasonably sure of the authenticity of the data returned if all of the below are true: The site supports DNSSEC The site's TLD supports DNSSEC Your client checks DNSSEC - For a browser I recommend the extension at dnssec-validator.cz (...


5

I am the lead architect of a very popular vulnerability database and we face similar problems. At the moment we have nearly 90'000 vulnerability entries with a CVSSv2 base and temp score. We are adding CVSSv3 scores and trying to convert most of the old data. I am going to discuss this transformation only to illustrate the basic principle of such. The most ...


5

The Factor Analysis of Information Risk (FAIR), or any Value-at Risk (VaR) model, whether based on MC (Monte Carlo Method), Bayesian statistics, or other sound variable-crunching, model-bound, formulaic risk analysis -- any of these will culminate is a more-efficient risk calculation. If you are a member of ISC2 (e.g., CISSP), you can check out CyVaR by ...


5

I'd suggest that trying to apply numeric values to abstract constructs like "risk", "impact" and "likelihood" isn't likely to be a great idea. The problem is that each of these terms tends to be both subjective (what's likely to one person isn't likely to another) and extremely situational (the impact of XSS on one site will be likely different to another)...


5

There are some downsides to having your email spread to strangers: The more spread your email is, the more likely you are to get spam, phishing emails, emails containing malware, etc. If anyone of those 10 people get infected by a virus, your email address will be in their contact list. (Recieving such emails does not automatically mean that you will get ...


5

Any software is of course bound to have vulnerabilities; Nonetheless there have been a couple of high-profile cases in these last few years relating to bloatware or preinstalled utilities Lenovo/Superfish: A Tool called Superfish Visual Search was shipped on Lenovo consumer laptops since late 2014. It contained a self-signed root certificate that made the ...


Only top voted, non community-wiki answers of a minimum length are eligible