Collaborate Disseminate
I have heard about this, but not sure how it would work.
I would imagine that when you register the device, the public RSA key burnt into the chip would be shared.
That way, if the application sends a challenge, the TPM uses the private ke… Continue reading How does a cloud based application use a TPM to authenticate hardware devices?
I am struggling to appreciate the differences between the 7 steps of the NIST Framework for Improving Critical Infrastructure, which should help an organisation implement it.
Step 1: Prioritize and Scope. The organization identifies its
b… Continue reading What are the differences between "identifying threats and vulnerabilities" and "risk management"?
Now that everyone is working from home using VPN, if infected by any malware, is lateral movement possible?
Is there any benefit to signing a random number?
e.g. a link for password reset, sent to email, often includes a base64 encoded random number to prevent someone guessing what the password reset link would be.
If that number… Continue reading Benefits of signing a random number
I’m attempting to create a domain-based whitelist to allow Google Chrome to be updated.
Where can I discover the current list of domains that Google Chrome uses for its self-update?
The twist is that the Google search engin… Continue reading Which domains does Google Chrome contact for self-updating? [on hold]
Do businesses need to be trained to understand ransomware is also a breach and needs to be treated as such with disclosure to compliance orgs, other regulators and investors?
Or do you feel most businesses realize this is th… Continue reading Do businesses consider ransomware they recover from as a breach? [on hold]
I sometimes need to send faxes and thought I would buy a modem for doing this and use Windows Fax and Scan software that comes with Windows 10. Does the type of or specifications of the modem determine if my data will be secu… Continue reading Security with sending faxes from pc
I need to get new computer speakers/subwoofer and bluetooth speakers sound great since they would decrease the amount of wires around my desk. Is there a security risk having bluetooth enabled all the time or anytime I would … Continue reading Is there a security risk using bluetooth computer speakers?
I am building an application (“A”) that can interface with a 3rd Party data API (“B”). A is commissioned by Organization “X”, which has data on B. Users of A need access to Org X’s data on B. However, B has no record of A’s users.
A and B live on different servers and communicate through public internet. User’s of A login with username and password and are issued an expiring access-token that authenticates HTTPs requests to A’s data API. My question is how to best secure communications from A’s data API to B’s data API.
In other words, what is the best way to ensure request’s to B are really coming from A? Should A store some kind of non-expiring Bearer-token that B can authenticate?
Note that the developers of B have agreed to make some modifications to B in an effort provide A the data it needs, but modifications should aim to be minor.