IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [countermeasure]

A countermeasure is an action, process, device, or system that can prevent, or mitigate the effects of, threats to a computer, server or network.

A countermeasure is an action, process, device, or system that can prevent, or mitigate the effects of, threats to a computer, server or network.

54 questions
129
votes
11 answers

Is there any way to safely examine the contents of a USB memory stick?

Suppose I found a USB memory stick lying around, and wanted to examine its contents in an attempt to locate its rightful owner. Considering that USB sticks might actually be something altogether more malicious than a mass storage device, is there…
200_success
  • 2,144
  • 2
  • 15
  • 20
36
votes
5 answers

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I bet it's all true and I believe them that they take…
Tom
  • 461
  • 4
  • 4
24
votes
8 answers

How to protect against brute forcing

How do you properly implement defenses against brute forcing? Is it best to store how many times someone tried to log in and block them after X attempts? And how would "someone" be identified? With the session? An IP?
Andreas Arnold
  • 2,353
  • 19
  • 19
19
votes
7 answers

Best practises for preventing SQL injection?

SQL injection is always a hot topic particularly when it comes to web security. In this regard I am interested in what are the steps that should always be taken to prevent SQL injection within any web application? Also in addition to these normal…
Mark Davidson
  • 9,367
  • 6
  • 43
  • 61
18
votes
3 answers

Does an ORM framework such as Hibernate completely mitigate SQL injection?

I know that to prevent all or most SQL injection attacks that you should use parametrized queries. I've been using Hibernate for a while instead of hand writing my SQL statements. Are there any known attacks or research that is directed toward…
Casey
  • 895
  • 5
  • 18
12
votes
4 answers

How should I secure a contact form that appears on every page of a website?

My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my responsibility to implement some type of security against…
Eric Belair
  • 281
  • 2
  • 6
7
votes
2 answers

Best practices for verifying a users identity for helpdesk

I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted, I know these can be spoofed, but the upper-level executive…
user2041774
  • 71
  • 1
  • 2
7
votes
3 answers

What countries are at highest risk of espionage on personal devices?

When co-workers travel internationally for business there seems to be risk of bringing a regular work laptop to some countries: the risk is that the government might try to spy on the dta stored on your device. The one's that immediately come to…
pzirkind
  • 707
  • 6
  • 12
6
votes
4 answers

How can I handle open ports?

After port scanning my company's network, I found a lot of open ports. What are the risks that will result out of these ports, if I left them open? And is there any way to handle them without closing them?
user78389
  • 77
  • 1
  • 1
  • 2
6
votes
3 answers

Is Content Security Policy an approach that is worth to support?

Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag and that are on a whitelisted domain are executed.…
Hendrik Brummermann
  • 27,118
  • 6
  • 79
  • 121
6
votes
1 answer

What is the difference between cybersecurity and information security?

I'm trying to differenciate between those two themes : cybersecurity vs information security. Broadly speaking I'd say cybersec is about network security (TCP/IP, router, firewall,...) and infosec is about data security (data exfiltration, wikileaks…
Jason Krs
  • 359
  • 2
  • 3
  • 12
5
votes
1 answer

SQL Injection on URL, not on parameters

Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
Ihab
  • 51
  • 1
5
votes
6 answers

Spam fighting idea

I have this crazy idea that spam e-mail would not be worth the time of the senders. This is how it's going to work. Someone sets up a reputation-based site, much like stackexchange sites, where people post stories about how they prank their spammers…
Steinbitglis
  • 159
  • 3
4
votes
3 answers

What alternatives do email services provide when an account is hacked?

I am concerned about how does email services like Yahoo, Gmail, Hotmail etc provide security to their costumers and prevent their account from being compromised. For example, I have seen that if someone tries Brute Force Attack on Yahoo. After some…
user4541
4
votes
1 answer

Why are countermeasures against control-flow hijacking attacks mostly implemented in software?

I wonder why countermeasures against code-injection and control-flow hijacking attacks (e.g. stack-based buffer overflows and heap-based buffer overflows) are mostly implemented in software. Examples of popular and widely deployed countermeasures…
user3171258
  • 41
  • 4
1
2 3 4