Collaborate Disseminate
I am wondering how best to characterize the security mindset (as explained by Bruce Schneier) for myself and for explaining it to others.
I would be interested in answers that attempt to characterize the essence of the secur… Continue reading How to characterize the security mindset? [on hold]
The Wikipedia definition of phishing is:
the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers
But, no… Continue reading Why is phishing becoming synonymous with ransomware?
A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where “virus” includes trojans, rootkits, et al.)
This does not help when defending against zero-days and active intrusions. By defi… Continue reading What do you call an antivirus that detects suspicious activity?
I know that the term “rights” applies to users or groups of users (such as “the user X has the right to change system time”) and the term “permissions” applies to an object (such as a folder or file, e.g. “the user X has ful… Continue reading What is the difference between Right and Permission?
I know that the term “rights” applies to users or groups of users (such as “the user X has the right to change system time”) and the term “permissions” applies to an object (such as a folder or file, e.g. “the user X has ful… Continue reading What is the difference between Right and Permission?
I forget what word it is that refers to the work of turning known bugs into real-world attacks, for example when people string together two separate exploits to break out of the Chrome sandbox. It’s not “weaponize”, it’s not … Continue reading Verb for "turning a bug into an attack"?
In a command injection you trick a service into doing something for you that it would not normally do. Does that mean that command injections are examples of (exploiting) confused deputies? Does the reverse also hold?
More generally, are … Continue reading Are command injections examples of confused deputies?
What is the difference between an IT security policy, an information security policy and a cyber security policy?
Continue reading Difference between cyber security and information security?
My understanding is that a strict definition of anonymity means that defeating the security mechanism is logically impossible or mathematically infeasible, and therefore so is deducing the identity. (An example would be blind… Continue reading What category of anonymity do onion routing and blockchains afford?
In a recent discussion re Tory Minister and British Home Secretary Amber Rudd’s insistence that WhatsApp install a backdoor for government monitoring of encrypted data, I brought up Enigma as an early example of a system that… Continue reading Would one consider the breaking of Enigma in WWII to be an early example of a backdoor?