This post guides you through the process of setting up PGP on OS X and registering a Keybase account. Configure Thunderbird and create a verified Keybase profile that allows you to send and receive encrypted email messages with other Keybase members.
Tag: secops
Checklist for Incident Response Teams
Forming a Computer Security Incident Response Team (CSIRT) is a complex affair. It normally involves a certain combination of staff, processes and technologies.
However the essentials are the same in most situations, no matter what the mission of your CSIRT is. This publication attempts to provide a list of must-have technologies for all forming incident response teams out there.
Credentials in the Ashley Madison Sources
One of the security risks of software development is passwords and other credentials hard-coded into the source code.
A quick analysis of the leaked Ashley Madison dumps shows that software developers of AM forgot about these risks. Their source code contains AWS tokens, database credentials, certificate private keys and other secret credentials.
The consequence of this is a more vulnerable infrastructure, which probable made the lateral movement easier for the Impact Team.
We’re Here to Make Things Secure
While Hacking Team was cleaning up the mess, security professionals were raging on Twitter. The company was publicly shamed for its bad passwords, worse reaction and questionable business practices on social media.
But was it really necessary to post random screenshots of private emails from the 400 Gb pack, totally out of context? Or mock HT employees because of something they already knew? Dumping their source code on GitHub?
Thoughts on the recent breach at Hacking Team, privacy and responsible behavior of security professionals
Session IDs as Query Parameters Must Die
Purge those nasty JSESSIONID and PHPSESSID parameters from the URL bar. Now. Sensitive data in GET parameters are bad. Even over HTTPS.
Check out this session ID killer proxy built on nginx, that converts these sensitive query parameters into safe and secure cookies.
Never Say ‘No’ to Direct Database Access
Direct access to databases is usually a privilege of DBAs and not end-users. Nonetheless, end-users have to access DBs in certain situations like generating sales reports, making ad-hoc queries, exporting data into spreadsheets and so on. From the security perspective, this is clearly not ideal, as a typical application was never designed to be utilised this way. Instead of saying ‘no’ to […]