Oct
10
answered SMS not received and read by somebody else (no SIM swap)?
Oct
6
comment Learning how to audit a linux system, what does it mean to configure password & system auth?
Since those files are part of the PAM subsystems, the section "Configure PAM" does indeed specify how they should be configured.
Sep
12
comment Authenticated vs Unauthenticated network scans
And a variety of privilege escalation is when not only anonymous/authenticated access but also multiple levels of authentication are supported; a regular user should not get more privileged (admin) levels of access or access to content belonging to a different authenticated user.
Aug
6
revised Is it a security risk to give out ssh key and one of or both public and private keys to my webhosting provider?
added 656 characters in body
Aug
6
answered Is it a security risk to give out ssh key and one of or both public and private keys to my webhosting provider?
Jul
7
comment Computer name naming convention for security
@jpmc26 : Hence the classification of a "low impact" risk with the rationale "And knowledge of the role of a server as disclosed by a hostname does not automatically make it more vulnerable (only more or less valuable [as a potential target] )." _-_Based on port scan you may find a database server, the hostname may instruct you it is a development instance (in theory without any real data, but frequently also with less security and the same data model) as opposed to a production database system (with more valuable data) where, when you are time constraint, you select to focus.
Jul
6
awarded  Commentator
Jul
5
awarded  Guru
Jul
5
awarded  Enlightened
Jul
5
awarded  Good Answer
Jul
5
comment How to make USB drive read only and write by a password or key or certificate?
See also security.stackexchange.com/q/96230/77995
Jul
5
awarded  Mortarboard
Jul
5
awarded  Yearling
Jul
5
comment Is there any security benefit to using physical machines over VMs?
All things being equal: Installing a hypervisor on a physical server and then running your OS and application in a VM is not inherently more "secure" or more insecure than installing the OS and application directly on the that same physical server. Typically though you won't do such one-on-one virtualisation and the VM will be on a shared platform with different and additional security trade-offs, complexity and benefits and delegation of control.
Jul
5
comment Computer name naming convention for security
@reirab - "An attacker will need to spend (significant) more effort" is the most common argument people seem to have against using logical, descriptive and predictable host names for servers and services. Effort is maybe not the best word, a portscan is not a lot of work, but is much more likely to trigger an alert than probing only the specific ports 1521 (Oracle listener) 3306 (MySQL) and 1433 (SQL server) on a host named db1.prod.int.example.com.(and thanks for the correction)
Jul
5
awarded  Nice Answer
Jul
4
revised Computer name naming convention for security
added 16 characters in body
Jul
4
answered Computer name naming convention for security
Jul
4
comment Computer name naming convention for security
I'm of the camp that believes that completely random host names won't hinder an attacker much if at all and will cause more problems (for users and administrators alike) than a predictable host name convention. Also see security.stackexchange.com/q/178328/77995 and RFC 1178
Jul
4
comment How to know what version of extensions are used in joomla-web-site from user's point of view?
From a security perspective you typically don't want to advertise which software version you're using to random site visitors. Developers should only provide an easy method to show the version to site admins and other trusted users. (Exposing version numbers to the general public can reduce finding your vulnerable site and abusing it to entering a version number in a search engine once a version is known to be vulnerable ....)