Skip to main content
12 votes

How do I decide which security framework is most suited to my organization?

There are 3 main considerations when deciding to choose a framework: What are your stakeholders expecting from you? Why are you choosing a framework? I.E. What outcomes are you looking for? Which ...
schroeder's user avatar
  • 129k
8 votes

What does a "-" mean in the Version field in Common Product Enumeration (CPE)?

According the the standard (https://cpe.mitre.org/files/cpe-specification_2.2.pdf), it should mean NA: "It is often necessary to use a CPE Name when identifying a specific release of a given platform....
Jason's user avatar
  • 101
7 votes

Friendly reminders for people who don't lock laptops

Those cards will be seen as punitive no matter how well you phrase them. There's another way: cards for those who locked their machines! Punishing behavior you don't want won't always mean that you ...
schroeder's user avatar
  • 129k
6 votes

Is there a specification for the color values representing information classification levels for the United States?

Ok so after diving into this a bit, this is the best I can come up with. I do not work for the US government so I cant say anything with any level of confidence. However; It seems that the color ...
Nalaurien's user avatar
  • 1,654
5 votes
Accepted

What risk rating models are used for calculating risk scores of web vulnerabilities?

The Factor Analysis of Information Risk (FAIR), or any Value-at Risk (VaR) model, whether based on MC (Monte Carlo Method), Bayesian statistics, or other sound variable-crunching, model-bound, ...
atdre's user avatar
  • 19.1k
5 votes
Accepted

Attack tree file format?

There were discussions of placing attack trees 1, 2 in existing SGML derivatives 3 that describe system architecture or govern security modules, but nothing like unanimity appears to have been reached....
Douglas Daseeco's user avatar
5 votes
Accepted

How do I measure compliance to Information security policies?

A good information security policy should very clearly state a number of things. At least the following: The reason why it was implemented its goals its scope its boundaries (the things it does not ...
Tom K.'s user avatar
  • 7,976
5 votes
Accepted

What is the PKCS#7 detached signature format?

From section 7 of RFC 2315: 3. The optional omission of the content field makes it possible to construct "external signatures," for example, without modification to ...
Steffen Ullrich's user avatar
4 votes
Accepted

Is Blowfish validated against any standards?

Blowfish is an algorithm. An algorithm isn't validated against anything. What is validated is an implementation of an algorithm. Blowfish isn't defined by any text that calls itself a standard, as ...
Gilles 'SO- stop being evil''s user avatar
3 votes
Accepted

Signature in ECDSA-signed X.509 certificates

The format you mentioned is the ASN.1 type ECDSA-Sig-Value as specified in RFC5480: Elliptic Curve Cryptography Subject Public Key Information: ECDSA-Sig-Value ::= SEQUENCE { r INTEGER, s ...
mat's user avatar
  • 1,272
3 votes

Is there any real-world use of IPsec modes other than ESP tunnel?

ESP / tunnel mode is often used when you want to connect two different POPs' networks together: you're basically implementing a full network and routing layer on top of an encryption layer, and the ...
lidocaineus's user avatar
3 votes

What risk rating models are used for calculating risk scores of web vulnerabilities?

CVSS tends to be the risk rating model used in nearly all vulnerability reports. One model mentioned in Microsoft's SDL is called DREAD This is primarily used during the threat modelling stage to ...
Colin Cassidy's user avatar
3 votes
Accepted

How relevant is OWASP ASVS?

Any OWASP project is as relevant as the community behind it, for example the PHP project is now abandoned but ASVS seems pretty active still. Adhering to any OWASP best practice is always a good ...
Purefan's user avatar
  • 3,580
3 votes

Are there Secure Coding Standards other that CERT?

I'm aware of two: The OWASP Developer Guide (to go along with the OWASP Top 10). David A. Wheeler's Secure Programming HOWTO, which is a very long and very comprehensive guide.
Mike Ounsworth's user avatar
3 votes
Accepted

Is there a standard checksum for verifying multipart key fragments?

There is no standard algorithm for key verification*, but there are standard checksums. Assuming verification is done to detect simple mistakes when retrieving or submitting the key, any reliable ...
forest's user avatar
  • 66.8k
3 votes

Why are email clients prevented from seeing the envelope?

Alternatively, if I am incorrect about this: then in what way? You are comparing apples to oranges. The email Header is most closely equivalent to the physical mail Envelope - even better, the email ...
gowenfawr's user avatar
  • 72.9k
3 votes

Is there a documented security standard that forbids or discourages rolling your own crypto?

Perhaps you are looking for FIPS 140-2. The Federal Information Processing Standard Publication 140-2, (FIPS PUB 140-2), is a U.S. government computer security standard used to approve cryptographic ...
user10216038's user avatar
  • 8,113
2 votes

History of the CERT secure coding standards?

Not to be too snarky, but did you try googling "cert secure coding history"? First hit: https://www.securecoding.cert.org/confluence/display/c/History I believe the first paragraph covers "when and ...
Mike Ounsworth's user avatar
2 votes

Certifying software as secure

Certification depends on the nature of the software, how it will be used and where it will be used (country, industry, etc...). Without that specific information we can't help you. Third party ...
Lucas Kauffman's user avatar
2 votes

What is the current EU standard for data destruction?

I'm not 100% sure what the EU laws and guidelines would be however; I suspect it's left to the member states to decide what to issue in regards to deletion of personal information. with that said I ...
octo-carrot's user avatar
2 votes

What is the best Practice / Industry Standard for storing documents with social security numbers, date of birth, financial records, etc?

This is very broad and as such, it's a little hard to exactly cover everything that applies to each. However, I'll try to cover the ones that I know apply. Credit card information is generally ...
Ryan Kelso's user avatar
  • 1,230
2 votes
Accepted

Developing Small Business Information Security Standards

to start I suggest you to refer to the SANS top 20 critical controls that every year are released and updated. They are about policies, appliances and best practices that must be applied to reduce the ...
N111ck's user avatar
  • 46
2 votes
Accepted

Envelope formats to store (symmetric) encrypted text

The standard format for storing encrypted data is the Cryptographic Message Syntax (CMS), a.k.a. PKCS#7. Encrypted data contains a ContentEncryptionALgorithmIdentifier, which has to contain the type ...
mat's user avatar
  • 1,272
2 votes
Accepted

PDF encryption anomaly; version 1.5 using AES

Your understanding about AES is correct, it came into PDF in version 1.6 (see section 3.5 of PDF Reference v1.6 for details). PDF 1.6 and 1.7 (and ISO 32000-1) support AES in 128-bit mode. Adobe's ...
MattK's user avatar
  • 36
2 votes

What security standards apply to physical security for an infosec office

You probably want to have a look at the ISO 27001 standards. https://www.itgovernance.co.uk/iso27001 Here are a couple of web pages specifically focusing on the physical aspects of offices for ...
JesseM's user avatar
  • 1,942
2 votes
Accepted

How to find CAPEC items related to a CVE

The CAPEC schema contains a field - RelatedWeaknessesType or Related Weaknesses (version 3.0) which references one or more CWE ids related to the specific CAPEC entry. From this appropriate mappings ...
SyCode's user avatar
  • 210
2 votes
Accepted

Trustable Sources For Security Algorithms and Standards?

There is no central repository from where to get this kind of source. What you should do, is to get the official publication of any standard you want to refer too. You can either find it by yourself,...
M'vy's user avatar
  • 13.1k
2 votes

Are there currently any standards for Homomorphic encryption?

There's an ISO publication currently under development called "Information technology security techniques -- Encryption algorithms -- Part 6: Homomorphic encryption". It is listed under ISO/IEC DIS ...
Tom K.'s user avatar
  • 7,976
2 votes
Accepted

Is AES the recommended symmetric cipher for production level software?

Answering your questions in reverse order: Why use a standardised cipher? It is very difficult to create a cipher that is secure against many possible attacks, while maintaining good performance, ...
auspicious99's user avatar
2 votes
Accepted

What does a TPM have in common with smart cards?

Both smart cards and TPM are computing environments that can store cryptographic keys and perform cryptographic operations, and performing cryptographic operations involving keys that they store is ...
Gilles 'SO- stop being evil''s user avatar

Only top scored, non community-wiki answers of a minimum length are eligible