User Eloy Roldán Paredes

39 votes

10 answers

6k views

Why is it important to apply security best practices when the risk they protect against is very low?

asked Dec 11, 2015 at 10:57

21 votes

3 answers

431 views

What precautions should I take when creating users that will be used by applications and not by people?

asked Dec 24, 2015 at 7:54

14 votes

1 answer

6k views

May HSTS block access to your site when you renew your SSL certificate?

asked May 27, 2016 at 17:51

9 votes

3 answers

3k views

Are future TLS versions going to prevent traffic inspection?

asked Dec 26, 2015 at 11:34

6 votes

1 answer

2k views

Is the native sandbox of Chrome and Firefox enough or would SELinux improve its security?

asked May 27, 2016 at 17:48

5 votes

1 answer

575 views

How to implement a password change policy when user's centralized password is in a lot of places?

asked Jan 8, 2016 at 8:25

3 votes

1 answer

186 views

How to block BYOD users from installing malicious versions of a common app?

asked Dec 10, 2015 at 8:01

3 votes

1 answer

529 views

Can in a VPN LAN-to-LAN one site be completely isolated from the other?

asked Nov 6, 2015 at 9:41

3 votes

4 answers

7k views

Can CVE-2015-4852 be exploited against WebLogic servers after a load balancer?

asked Nov 13, 2015 at 18:59

3 votes

1 answer

172 views

Is there any risk in adding exceptions in the antivirus software for paths that are only writable by Administrator?

asked Apr 1, 2019 at 16:47

3 votes

1 answer

170 views

What are the new risks of using hyperconvergent systems?

asked Oct 1, 2016 at 6:45

3 votes

3 answers

2k views

What is the risk of allowing users to change Windows 10 wallpaper?

asked Oct 7, 2016 at 12:01

3 votes

1 answer

295 views

Where should we maintain external (subcontractors) usernames and passwords?

asked Nov 11, 2016 at 9:50

3 votes

5 answers

2k views

May be justified to use generic and shared user accounts in order to segregate and reduce risk?

asked Jun 1, 2016 at 7:09

3 votes

1 answer

2k views

What security controls should be in the API Gateway and what in the webservices?

asked Sep 3, 2016 at 12:03

2 votes

3 answers

196 views

May I have into account security concerns when considering to send emails massively (>100,000)?

asked Aug 31, 2016 at 17:58

2 votes

1 answer

211 views

What security requirements should implement a L2L VPN in order to protect one end from the other?

asked Sep 9, 2017 at 9:39

2 votes

1 answer

167 views

What is the procedure to implement security zones in a production network without impacting negatively in the communications?

asked Nov 20, 2015 at 17:36

2 votes

1 answer

1k views

What are the risks of allowing the storage of persistent cookies on your system?

asked Dec 3, 2015 at 12:47

2 votes

2 answers

589 views

Why not to use the same subordinate issuer CA for generating certificates that will be used for different things?

asked Dec 28, 2015 at 12:25

1 vote

1 answer

139 views

When automatic login may be acceptable from the point of view of security?

asked Dec 24, 2015 at 16:59

1 vote

2 answers

154 views

Is it possible to protect the emails and calendar in an Exchange server against own Exchange administrators?

asked Nov 6, 2015 at 17:47

1 vote

1 answer

166 views

How can I authenticate securely to an internal website from an iPad without an strong password?

asked May 27, 2016 at 17:57

1 vote

0 answers

100 views

How to know and disallow corporative Google Apps users to access third party apps with their corporative Google Apps accounts?

asked Jan 21, 2016 at 11:34

1 vote

2 answers

215 views

Is it reasonable to make mandatory inside an organization (in the internal network) that all traffic were encrypted?

asked Jan 21, 2016 at 15:10

1 vote

1 answer

298 views

Linux authenticating against Active Directory, is one keytab for all Linux machines enough?

asked Nov 11, 2016 at 10:02

1 vote

4 answers

193 views

Is there a criteria for allowing or disallowing the execution of bash scripts as root with sudo?

asked Sep 7, 2016 at 14:34

1 vote

1 answer

962 views

Does putting in quarentine attachments with two dots increase security in Outlook 2010?

asked Jun 1, 2016 at 11:03

1 vote

3 answers

336 views

Is it secure to send a password recovery link for company application to an employee's personal email address?

asked Jun 4, 2016 at 9:27

0 votes

1 answer

296 views

Should all local users with the same username have the same UID in all the machines of an organization?

asked Aug 17, 2016 at 11:34

Stack Exchange Network

36 Questions

Why is it important to apply security best practices when the risk they protect against is very low?

What precautions should I take when creating users that will be used by applications and not by people?

May HSTS block access to your site when you renew your SSL certificate?

Are future TLS versions going to prevent traffic inspection?

Is the native sandbox of Chrome and Firefox enough or would SELinux improve its security?

How to implement a password change policy when user's centralized password is in a lot of places?

How to block BYOD users from installing malicious versions of a common app?

Can in a VPN LAN-to-LAN one site be completely isolated from the other?

Can CVE-2015-4852 be exploited against WebLogic servers after a load balancer?

Is there any risk in adding exceptions in the antivirus software for paths that are only writable by Administrator?

What are the new risks of using hyperconvergent systems?

What is the risk of allowing users to change Windows 10 wallpaper?

Where should we maintain external (subcontractors) usernames and passwords?

May be justified to use generic and shared user accounts in order to segregate and reduce risk?

What security controls should be in the API Gateway and what in the webservices?

May I have into account security concerns when considering to send emails massively (>100,000)?

What security requirements should implement a L2L VPN in order to protect one end from the other?

What is the procedure to implement security zones in a production network without impacting negatively in the communications?

What are the risks of allowing the storage of persistent cookies on your system?

Why not to use the same subordinate issuer CA for generating certificates that will be used for different things?

When automatic login may be acceptable from the point of view of security?

Is it possible to protect the emails and calendar in an Exchange server against own Exchange administrators?

How can I authenticate securely to an internal website from an iPad without an strong password?

How to know and disallow corporative Google Apps users to access third party apps with their corporative Google Apps accounts?

Is it reasonable to make mandatory inside an organization (in the internal network) that all traffic were encrypted?

Linux authenticating against Active Directory, is one keytab for all Linux machines enough?

Is there a criteria for allowing or disallowing the execution of bash scripts as root with sudo?

Does putting in quarentine attachments with two dots increase security in Outlook 2010?

Is it secure to send a password recovery link for company application to an employee's personal email address?

Should all local users with the same username have the same UID in all the machines of an organization?