With the release of OpenDLP, more and more people are hearing about DLP. What is it and how does it work? Fundamentally, security is about protecting important data – whatever that data happens to be – a formula, a trade secret, social security numbers, etc. We have all kinds of tools and techniques to help us encrypt and protect our data from someone outside of the company, but what about from people inside the company, people who go against company policy and use gmail, rapidshare, or other convenient tools to let them work at home or on the road? While seemingly innocent, these users are the ones that can cause the most problems.
Category: Technology & Tool Thursday
Each Thursday, Security Musings features a security-related technology or tool. Featured items do not imply a recommendation by Gemini Security Solutions.
Everyone has their browser of choice; mine is FireFox, because of its level of extensibility and huge collection of user-created add-ons. There are many useful add-ons that deal with security. Here are 4 that deal specifically with SSL and certificates, and two that are just useful in general. Export All Certificates This add-on allows you to export all of the trust roots from Firefox in one operation. I can’t really think of a situation where this would be extremely useful, but it may be convenient for testing purposes. https://addons.mozilla.org/en-US/firefox/addon/141504 Conspiracy This plug-in adds some UI next to the SSL icon that shows the country of origin for the root certificate that issued an SSL cert. https://addons.mozilla.org/en-US/firefox/addon/107867 CipherFox Displays the current[…]
I recently found out about Netsparker through Darknet. They released an update to their community edition (free). The main thing about Netsparker that caught my eye is its fundamental approach at eliminating false positives in its web application scanning. I completely agree with the developers’ approach. The developers thought that if you need to investigate every single identified issue manually what’s the point of having an automated scanner? So I decided to check out Netsparker a little further and put it to the test. I first started by running its array of scans against a few local web applications I had on my system. Most are either internal development projects or just sandbox sites I use for testing random stuff,[…]
In evaluating web application security, I’ve built up a toolbox of Firefox add-ons that make testing and experimenting much easier than manual techniques. One of my favorites is a little tool called HttpFox. While no match for a professional HTTP sniffer, HttpFox provides enough functionality for many basic testing situations. If you want to see what’s happening behind the scenes for a given web application, HttpFox lets you pull up a traffic log without leaving your browser. The plug-in displays a panel right in the lower half of the window and captures a list of every HTTP request made during a given session. (You control the capture through start and stop buttons.) Highlighting an individual request brings up detailed information[…]
Raise your hand if you use Microsoft’s Remote Desktop client. Keep your hand raised if you have ever wondered how a Remote Desktop session is secured. Finally, only keep your hand up if you have acted on your curiosity and now know the method of encryption used to secure RDP communications and how vulnerable it is to attack. If your hand is still raised, congratulate yourself for being so security-conscious, but be aware that you are sitting at your computer with your hand in the air because a blog post told you to. As for everyone else, you should read on. The good news is that the Remote Desktop Protocol (RDP) is indeed encrypted using RC4. The bad news is[…]
Probably one of the first things you find out when you transition from “This is fun. Let’s learn some stuff about ethical hacking,” to breaking into doing it professionally is that it’s imperative to keep track of everything. Clients are going to want a little more information than “Oh look I broke in! I’m so cool!” They are going to want an in-depth report (a whole new skill to learn). Thus keeping records of what you did as you do it becomes a vital part of the job. Additionally, whether working on a pentest, playing red at a cyber defense competition, or pretty much any other large project, chances are you will find yourself working on a team. In school[…]