Collaborate Disseminate
Can I secure a website using a simple whitelist system?
My idea is to port forward a website www.example.com on my pc.
To secure it, I want to add a whitelist system. It will work like this:
When the server receives a request, it will read… Continue reading Restrict web access with whitelists
We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn’t allow any executable content. All the CSS is put through a whitelist par… Continue reading Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?
We publish a Windows desktop app, and while I’ve run VirusTotal on all of our files with no hits, some security software blocks incoming connections on ports we use, leading to frequent user support issues. Both our installer and the insta… Continue reading Whitelisting our app to prevent connection blocking?
I am about to use OWASP CRS rules with mod_security on my WHM/cPanel enabled CentOS server (with apache). But I fear that accidentally Googlebot may be blocked by one rule or the other. After enabling OWASP CRS, If I add the below custom r… Continue reading mod_security with OWASP CRS: Custom rule for whitelisting googlebot
I was told that IP whitelisting should not be considered safe and are hence obsolete.
I fail to understand why this statement holds: can IPs be impersonated? if not, then why is it a bad/obsolete way of securing a service? (assuming the tr… Continue reading Risks associated with IP whitelisting
I want to create a security baseline for an industrial asset that is based on a Windows 10 LTSC.
In the meantime, I have compared several providers of classic antivirus software and wonder if there are any alternatives. Or if I can guarant… Continue reading Creating a security baseline for industrial assets [closed]
I am just starting out on cyber security and one of the recommendations to us was to check out "MIT Licensed Whitelisting Agent". At first I thought this would like a service I would download and allow/block applications but I do… Continue reading MIT Licensed Whitelisting Agent [closed]
If I were to configure a server that would be configured to only be accessible (HTTP) from a single IP address via a port, is it safe from unauthorized access?
I have a question how to deal with whitelisting field arrays in modsecurity. Currently am doing the following:
… ctl:ruleRemoveTargetById=942510;ARGS:_owc_pdc_faq_group[0][pdc_faq_answer]"
… ctl:ruleRemoveTargetById=942510;ARGS:_o… Continue reading Modsecurity CRS how to deal with field arrays
I have a public hosting server. I want to give access to it only from one specific IP address. Since it’s a public hosting I don’t have access to its infrastructure or apache configuration. I can create .htaccess file only. Based on that c… Continue reading How to allow access from just one IP in htaccess