pm1391
  • Member for 3 years, 10 months
  • Last seen more than a week ago
2 answers
2 votes
270 views
Is it correct to assign a CVSS to a misconfiguration?
2 votes

As noted in the comments, your HTTP example would not be a misconfiguration. But, certain configs can result in or amplify vulnerabilities. For example, if a endpoint on a web app does not enforce ...

View answer
4 answers
0 votes
173 views
Can a website be used for targeted attacks?
1 votes

1.) You can never be sure that a website is 100% safe. A recent scan from VirusTotal definitely helps but you can’t be sure. 2.) It is a pretty safe bet that a website with billions of visitors can ...

View answer
4 answers
0 votes
1k views
Is it a bad idea using two firewalls on the same PC?
1 votes

It depends, mainly on the third party firewall. I have seen cases where trying to install two software firewalls will make them both freak out or force the uninstallation of the other one. Of course, ...

View answer
3 answers
0 votes
215 views
Can information sent over unencrypted http still be seen if I'm on an encrypted wifi?
Accepted answer
3 votes

Your data would only be protected by WPA2 to the router. Beyond that, if it is not protected by TLS/SSL (HTTPS), your data was most likely sent in the clear. As for how much of a risk? Not much ...

View answer
3 answers
3 votes
233 views
How should we implement responsible discovery program internally only for our organization employees?
3 votes

In my experience, users do not report security issues because of a couple of reasons: They don't care or believe its not their job They don't understand the possible impact of a security ...

View answer
1 answers
6 votes
405 views
Security consequences of a publicly accessible database?
4 votes

The bells ringing in your head are correct and I would be right there with you. This is a bad practice and I am afraid I have seen it done many times. Here are some vulnerabilities and threats that ...

View answer
3 answers
2 votes
268 views
How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?
1 votes

You bring up a good point. EDR (Endpoint Detection and Response) has been created for this very reason. Vendors such as Crowdstrike do a great job at protecting endpoints. To my knowledge, most EDR ...

View answer
7 answers
36 votes
12k views
What are the security risks of logging the hash of rejected passwords?
18 votes

This is not a common practice, and goes against security in general. IMHO, none of the reasons you list are good enough to log hashed passwords. In fact, I can’t think of a good reason to log them. ...

View answer
1 answers
3 votes
111 views
How should privileged users keep each other in check?
Accepted answer
2 votes

This comes back to the "separation of duties" and "least privilege". In a ideal situation, admins in the IT department would not have access all across the board. One admin might have complete access ...

View answer
2 answers
3 votes
744 views
AppSec Developer Certifications
2 votes

In my experience, true programmers laugh at certifications (most of the time for good reason). They care much more about the projects you have worked on. Some jobs and companies value industry ...

View answer
2 answers
3 votes
292 views
preventing SQL injection with string length
-1 votes

There are tons of resources available on the best practices of taking input parameters and I have never seen only limiting the character length as a viable or secure option. So yes, a attacker can ...

View answer
2 answers
-1 votes
118 views
Secure access to an aplication from internet
1 votes

Please see my comment but hopefully this will provide you with a answer to get you started in the right direction. First, securing a application in the first place is not easy. Securing an application ...

View answer
1 answers
-3 votes
559 views
What architecture for a SIEM based on an ELK cluster?
1 votes

From a security perspective, I would recommend shipping and saving all the logs off site. You can use Filebeat/winlogbeat (which supports compression) to send to a remote Logstash. Logstash is very, ...

View answer
1 answers
3 votes
2k views
Secure RESTful api communication between multiple servers
Accepted answer
2 votes

Because you are mainly concerned with the security of your program (i.e preventing someone from issuing commands to your clients), you also have to identify your threat model. For example, if you are ...

View answer