Collaborate Disseminate
As attackers constantly innovate new exploitation and evasion techniques, enterprise security teams are having to stay ahead of a host of emerging threats. Often, these threats have been encountered in other enterprises, and shared knowledge of these t… Continue reading 3 Key Mobile Enterprise Threats in 2018
I apologize if this is a dumb question.
I recently came across a website that embedded its error log out in a JSON response if the request to the website failed. In this case, it appeared there was a DB mismatch and it print… Continue reading How dangerous is disclosing a table’s structure to users?
When using a multi-tiered web application is a two tiered or three tiered design more secure?
In a two tier model the web server and application server are one box. The database is separate. The connection string from the a… Continue reading Does a separate app server with a web service do much for security? [on hold]
Yesterday Oracle announced a new online transaction processing database service, finally bringing its key database technology into the cloud. The company, which has been around for over four decades made its mark selling databases to the biggest companies in the world, but as the world has changed, large enterprise customers have been moving increasingly to […] Continue reading Oracle’s database service offerings could be its last best hope for cloud success
Oracle executive chairman and CTO, Larry Ellison, first introduced the company’s autonomous database at Oracle Open World last year. The company later launched an autonomous data warehouse. Today, it announced the next step with the launch of the Oracle Autonomous Transaction Processing (ATP) service. This latest autonomous database tool promises the same level of autonomy — […] Continue reading Oracle launches autonomous database for online transaction processing
Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them.
Also, say you want to keep certain files inaccessible to people who do have access to the… Continue reading Restricting source code exposure
I just added some code to our app server to encrypt personal information before it’s stored in the database. This was mostly done for compliance reasons, but how much of an actual security win is it?
I hear about database du… Continue reading How helpful is encrypting/decrypting information on an app-server, and sending it to the database encrypted?
I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no sign that the injection wa… Continue reading Attempting SQLi against website with WAF filter [on hold]
I’m using the following library for hashing my password.
string password = BCrypt.Net.BCrypt.HashPassword(“stackoverflow”);
The length is apparently 60 each time. My question is, I’m planning to store these passwords in… Continue reading Bcrypt data type and length?
I’m working on a social network using Vue.js on frontend, and Node/Express on backend. To store user sessions I’m using Redis. I’m wondering if I should hit Redis everytime user requests content, or maybe there is a way to re… Continue reading Should I authenticate user on every request?