Scott Pack
  • Member for 11 years, 1 month
  • Last seen more than a month ago
Is it a bad idea for a firewall to block ICMP?
Accepted answer
134 votes

Compared to other IP protocols ICMP is fairly small, but it does serve a large number of disparate functions. At its core ICMP was designed as the debugging, troubleshooting, and error reporting ...

View answer
How do you destroy an old hard drive?
Accepted answer
94 votes

Physical destruction of a drive is tricky business. There are many companies that deal specifically in the field of data destruction, so if you are doing any kind of mass you may want to at least look ...

View answer
Should I change the default SSH port on linux servers?
Accepted answer
93 votes

The Internet is a wild and scary place, full of malcontents whose motives range from curiosity all the way to criminal enterprise. These unsavories are constantly scanning for computers running ...

View answer
How can I protect my internet-connected devices from discovery by Shodan?
63 votes

The Shodan project is pretty cool, but at its core isn't much more than a big honkin nmap database. The project has scanners that routinely scan the Internet and publish the findings into the database....

View answer
Difference between IDS and IPS and Firewall
Accepted answer
52 votes

The line is definitely blurring somewhat as technological capacity increases, platforms are integrated, and the threat landscape shifts. At their core we have Firewall - A device or application that ...

View answer
How can I punish a hacker?
49 votes

The term most often used to describe what you're talking about is Hacking Back. It's part of the Offensive Countermeasures movement that's gaining traction lately. Some really smart people are putting ...

View answer
What is the difference between authorized_keys and known_hosts file for SSH?
44 votes

Those two files are both used by SSH but for completely different purposes, which could easily explain your confusion. Authorized Keys By default SSH uses user accounts and passwords that are managed ...

View answer
Simple example auditd configuration?
Accepted answer
42 votes

Auditd is an extraordinarily powerful monitoring tool. As anyone who has ever looked at it can attest, usability is the primary weakness. Setting up something like auditd requires a lot of pretty in-...

View answer
Most secure way to partition linux?
Accepted answer
38 votes

Please keep in mind the Holy Trinity of Information Security: C(onfidentiality), I(ntegrity), and A(vailability). So when we talk about configuration hardening you need to consider the technology you'...

View answer
Why block outgoing network traffic with a firewall?
30 votes

Coming from a security role, particularly if you've ever been involved in incident response, the idea of outbound filtering would seem a natural course in a high security environment. However, it is a ...

View answer
What is the danger of hosting your SSL certificate yourself?
Accepted answer
25 votes

Using an SSL certificate for your websites primarily gets you two things: Identity proofing that your website is who it says it is Stream encryption of the data between the webserver and the client ...

View answer
What logs to retain for PCI-DSS?
Accepted answer
19 votes

Generally, the most conservative answer comes in the form of something easily understood, and approachable by the general populous. Ignoring the hyperbole of that kind of response, there are two ...

View answer
How are spoofed packets detected?
Accepted answer
18 votes

While I am sure there are, in fact, firewalls that may do that, I am not off-hand aware of any that operate this way. There are packet spoofing detection mechanisms, although they tend to act a little ...

View answer
Should a site have SSL if it doesn't have a login form?
16 votes

SSL provides several benefits not just data privacy. By presented a properly signed SSL certificate there are some assurances that the server your clients connect to actually is yours (let's assume ...

View answer
Wireless client isolation - how does it work, and can it be bypassed?
Accepted answer
16 votes

The implementation that I've seen of this is done by fiddling with the MAC forwarding table on the access point. Since the access point simply acts as a network bridge, it is fairly well suited to ...

View answer
What should be included in a jump bag and how often should it be reviewed?
16 votes

Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on ...

View answer
PCI DSS requirement 6.4.2 separation of duties between development/test environments
Accepted answer
15 votes

It is, of course, always wisest to accept the judgements of your QSA when making judgement calls, however during your own in-house compliance work I recommend checking out the Navigating PCI-DSS: ...

View answer
Erasing a hard-disk, encrypting it as alternative?
Accepted answer
15 votes

Modern research seems to indicate that performing a single zero-pass of a hard drive is sufficient for most data dispositions. In which case, no, performing a file or partition encryption would not be ...

View answer
Backtrack 5 in a VM - Why bridged networking over NAT?
Accepted answer
14 votes

When in NAT mode the network subsystem of the hypervisor operates by modifying the packets as they leave the host. Assuming TCP/IP over ethernet, the components definitely changed are: source address ...

View answer
Books about Penetration Testing
14 votes

I really enjoyed Erickson's Hacking: The Art of Exploitation Fyodor's own Nmap Network Scanning I have also heard heard great things about, but haven't read yet, The Web Application Hacker'...

View answer
Fresh Graduate Going into Penetration Testing
13 votes

A Little Background Penetration testing probably feels like the sexiest part of security, but it is also a very small part. It's also exceptionally broad. The term "penetration test" is ...

View answer
Virus detection with Process Explorer
Accepted answer
13 votes

Process Explorer, part of the SysInternals suite, is indeed a Windows only tool. It is largely intended to replace the standard Windows task manager. As such it gives very detailed information about ...

View answer
Do these ports mean anything?
13 votes

A Brief Note On Banner Grabbing The first, biggest, hurdle one faces when getting into vulnerability assessments or penetration testing is understanding the limitations of whatever detection mechanism ...

View answer
Is CentOS a good choice from a security perspective?
Accepted answer
13 votes

The short answer is this: No, CentOS 5.6 is inherently no more or less secure than any other modern supported operating system. The long answer is a bit more complicated. CentOS is the "Community" ...

View answer
Wireless keyboard sniffing risk
13 votes

One must also keep in mind that due to various considerations, primarily cost and regulations (depending on country), even your wired keyboard may be vulnerable to interception. A couple of ...

View answer
What are common/official methods of reporting spam/phishing/nasty-grams to organizations?
Accepted answer
12 votes

Most often, these kinds of emails are sent from either compromised hosts, spammer accounts at free webmail providers, or dedicated spam-spewing networks (this is called snowshoe spam). In either case, ...

View answer
PCI-DSS - one application per server?
12 votes

The one truism of PCI-DSS compliance is this: You are PCI-DSS compliant if your QSA says you are PSI-DSS compliant. I'm of the opinion that the PCI council did a pretty stinking good job of giving ...

View answer
Securing my web-server / website
12 votes

This is really a pretty stinking huge question. Based on your chosen tags it looks like you're asking for guidance on a LAMP stack, so we'll focus on that. There are already a number of related ...

View answer
Available Resources for Securing RHEL 6
11 votes

When it comes to something like a hardening guide, RHEL 6 is still considered fairly new. As sad as it seems, many of these types of guides take several months or years to produce. That being said, by ...

View answer
Honeyd: log grows too fast
10 votes

Usually a large number of log entries from a honeypot are from one of two reasons: Your environment is getting scanned like a smudged barcode. You made the mistake of putting your honeypot on a non-...

View answer