User Nathan Aw

44 votes

1 answer

6k views

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator? [duplicate]

asked Oct 25, 2021 at 4:15

32 votes

3 answers

6k views

How does one defend against software supply chain attacks?

asked Jan 20, 2021 at 10:14

9 votes

6 answers

5k views

A new programming paradigm (e.g., Rust) to reduce or end all zero-day vulnerabilities/exploits? [closed]

asked Mar 9, 2021 at 6:46

2 votes

0 answers

107 views

Assuming secure code practices are adhered to, is a thousand-tier/n-tier microservices application or a monolithic application more secure? [closed]

asked Feb 22, 2021 at 15:14

2 votes

2 answers

144 views

Are polyglot microservices (multiple technologies) more secure than using a single technology framework?

asked Jan 21, 2021 at 15:48

1 vote

2 answers

347 views

What is a reasonable timeframe that should be defined and enforced for access token expiry to reduce the risk of unauthorised access? [duplicate]

asked Jan 21, 2021 at 16:00

1 vote

0 answers

62 views

A single microservice (e.g., a spring boot jar) can be dependent on more than 100 libraries - how to ensure that none of these are compromised? [duplicate]

asked Feb 10, 2021 at 16:37

1 vote

2 answers

130 views

Can an API endpoint hosted running on K8S be breached to compromise the entire cluster? Were there ever such attacks?

asked Oct 8, 2021 at 7:52

0 votes

3 answers

215 views

Instead of waiting until zero-day exploits to happen, how to preemptively find zero-day vulnerabilities in order to deter zero-day exploits?

asked Oct 8, 2021 at 9:41

0 votes

0 answers

25 views

Zero day vulnerabilities & Cybersecurity Supply Chain Risk Management - how to move from a reactive posture to a proactive posture? [duplicate]

asked Dec 12, 2021 at 9:56

0 votes

1 answer

148 views

Does Log4Shell ("CVE-2021-44228 ") affect K8S/Containers and function-as-a-service (FaaS)?

asked Dec 14, 2021 at 17:08

0 votes

1 answer

109 views

What security controls to guard against malicious Insider Threat Engineers?

asked Jan 19, 2022 at 15:55

0 votes

1 answer

345 views

How does one detect and deter golden SAML attacks?

asked Jan 21, 2021 at 15:37

0 votes

2 answers

162 views

Use of distributed ledger/blockchain to stop data exfiltration? [closed]

asked Mar 16, 2021 at 16:38

0 votes

0 answers

31 views

supply chain security - ways of detecting and deterring compromise at a lower level i.e., hardware class of vulnerabilities [duplicate]

asked Jan 30, 2022 at 9:01

-1 votes

1 answer

201 views

Using Artificial Intelligence (AI) to detect unauthorized code modification to reduce and to even stop zero-day exploits [closed]

asked Mar 10, 2021 at 1:34

-1 votes

2 answers

872 views

Is Time-based one-time password (TOTP) sufficiently secure as another factor of authentication?

asked Jan 23, 2022 at 5:43

-1 votes

1 answer

143 views

As Multi-Factor Authentication (MFA) seems to be the holy grail to much of the threats, are there any cases where MFA is compromised? [closed]

asked Nov 6, 2021 at 2:58

-2 votes

1 answer

667 views

What is the relationship between fuzzing and buffer overflow? Does fuzzing leads to buffer overflow? [duplicate]

asked Feb 1, 2022 at 7:29

Stack Exchange Network

19 Questions

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator? [duplicate]

How does one defend against software supply chain attacks?

A new programming paradigm (e.g., Rust) to reduce or end all zero-day vulnerabilities/exploits? [closed]

Assuming secure code practices are adhered to, is a thousand-tier/n-tier microservices application or a monolithic application more secure? [closed]

Are polyglot microservices (multiple technologies) more secure than using a single technology framework?

What is a reasonable timeframe that should be defined and enforced for access token expiry to reduce the risk of unauthorised access? [duplicate]

A single microservice (e.g., a spring boot jar) can be dependent on more than 100 libraries - how to ensure that none of these are compromised? [duplicate]

Can an API endpoint hosted running on K8S be breached to compromise the entire cluster? Were there ever such attacks?

Instead of waiting until zero-day exploits to happen, how to preemptively find zero-day vulnerabilities in order to deter zero-day exploits?

Zero day vulnerabilities & Cybersecurity Supply Chain Risk Management - how to move from a reactive posture to a proactive posture? [duplicate]

Does Log4Shell ("CVE-2021-44228 ") affect K8S/Containers and function-as-a-service (FaaS)?

What security controls to guard against malicious Insider Threat Engineers?

How does one detect and deter golden SAML attacks?

Use of distributed ledger/blockchain to stop data exfiltration? [closed]

supply chain security - ways of detecting and deterring compromise at a lower level i.e., hardware class of vulnerabilities [duplicate]

Using Artificial Intelligence (AI) to detect unauthorized code modification to reduce and to even stop zero-day exploits [closed]

Is Time-based one-time password (TOTP) sufficiently secure as another factor of authentication?

As Multi-Factor Authentication (MFA) seems to be the holy grail to much of the threats, are there any cases where MFA is compromised? [closed]

What is the relationship between fuzzing and buffer overflow? Does fuzzing leads to buffer overflow? [duplicate]