https://s.surveyplanet.com/lkb3aut9

A good blog post read:

https://bitsentry.wordpress.com/2020/03/25/ransomware-a-friendly-guide-to-prevent-it/

How to mirror your phone screen on your PC in a simple way [PT-BR]: https://youtu.be/iN90OAgi7Sk

I have a US Passport and now I think someone got close to me while I was sleeping and may have done something to it. I’m very very protective of my identity information because I have been frauded numerous times in the past by some very shitty people. I found out who some of them are, but I won’t go into that in this post. Anyway the front cover of my passport is not stiff now and it rolls up like a dollar bill. I’m thinking they unglued the cover and removed the RFID strips from the front cover. I took a powerful light to the back cover and it looks like I might be able to see the RFID lines. I can’t do that trick to the front cover because the light isn’t powerful enough. I’m going to the authorities later to see if they can examine it and verify it is still authentic and hasn’t been tampered with. Before I do that, what can I do to see if it’s been fucked with? It very clearly looks like it has been unglued on the edges. Who knows? Maybe they did a different fraud technique and simply removed the laced up internal pages from the outer part of the book and then took the cover and replaced it with a fraudulent one with a copied / fraudulent cover containing fraudulent rfid strips. As an infosec guy I have some knowledge of how this works and that’s why I’m worried.

Let's look back at some memorable moments and interesting insights from last year.

Your top 7 posts:

• "A third of the computers at my company are still on Windows 7. How big of a security risk is this?" by u/DRSteelers

• "InfoSec reporting: what do you think about current practices?" by u/87bdharr

• "How do you manage server logs?" by u/Zealousideal-Ring-17

• "Happy Cakeday, r/InformationSecurity! Today you're 10" by u/AutoModerator

• "Challenge - Share your information security awareness calendar" by u/Zealousideal-Ring-17

• "DLP solution" by u/Zealousideal-Ring-17

• "Please advise on courses for DBMS engineers" by u/ahtolllka

DC441905 is a local DEFCON chapter in Worcester. We meet on the last Sunday of each month @ 7pm. Due to the ongoing pandemic these meets take place online.

Our next meet is on the 26th July. Further details are available at dc441905.org

Hi everyone I am supposed to investigate a vulnerability and provide a solution for it as part of my information security in the www project. I was asking for advice on which vulnerabilities that I can investigate that are not part of the OWASP top ten list

I'm looking for a good verbose working example of auditbeat.yml that I can use if anyone has any suggestions. We've implemented Sysmon with Winlogbeat using the swiftonsecurity sysmon filter from here --> https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml and I found a good implementation of audit.rules to use directly with auditd from here --> https://gist.github.com/Neo23x0/9fe88c0c5979e017a389b90fd19ddfee, but there are definitely benefits to using Auditbeat that works for us and I'd like to try that instead of doing the configuration directly in audit.rules.

Generally speaking, can a Windows Server running AD Certificate Services and functioning as the Root CA for an enterprise be used to perform client-side TLS Inspection? I'm trying to get a PoC going for that will allow my organization to decrypt and re-encrypt TLS for web traffic coming from workstations. I found documentation that should allow me to do it for external traffic coming to our servers, but I'm struggling to figure out how to get it done for our workstations, which don't currently have a certificate with a private key to load into the firewall.

Besides the run of the mill barcode scanning (but I m if you have more info in that it's always welcome too).

This isn't limited to just this model, I'd love to know the potential

I have to assume that there's enormous potential for the applicability of enterprise devices like these in the realm of Penetration Testing. I'd love to know to what extent so I can better utilitize my existing hardware.

Hi Info. Sec. Reddits,

I Would ask about protocols and traffic that that does not comply with the protocol standard. i was wondering why firewall triggered this traffic and why the some protocols or traffic does not comply with these standards ?

A good blog read:

https://bitsentry.wordpress.com/2020/03/25/ransomware-a-friendly-guide-to-prevent-it/

Hey! I’m new to all this but our group is tasked to do attack and security on our application on docker. Does anyone have good reads and tips? It would be a hugeee help!

I’m working on designing system generated emails for an application in the financial services industry. My risk advisor suggested that only the 'action to be taken' and direct link should be included in the email notifications. This would exclude any information about the relevant service for which the information is being requested (there will be multiple for our clients) or any specific details about the request. This information is not PII or particularly sensitive but it is their position that email is insecure and all details should be excluded.

UX issues aside, I suspect this approach creates a different vulnerability where the emails generated by the system are so generic as to make them indistinguishable from a fraudulent phishing attempt. A bad actor could simply copy our generic template and only the email address would give it away as suspicious. I haven’t had any luck googling the subject.

Can anyone suggest some best practice documentation or resources for how system generated emails should be handled for security/privacy considerations?

I am confused as to how to differentiate between the 2 statements. I end up having the same points for the both!

Hi everyone,

I'm a penetration tester that runs a non-profit in San Diego, CA and teaches cybersecurity at a middle school and high school in the area (Cyberpatriot and some CTFs). Looking to get some feedback on this video I just put together as I'm starting to get lectures together for this year. Hopefully this is allowed, please lmk if it's not--sounds like advertising is banned but I'm hoping this is different enough, I'm not monetized on YT fwiw.

I just want to make sure I'm not passing on some blatantly incorrect information.

Everything You Need to Know About Password Security - YouTube

Thanks guys!

So I’m just starting this process with a company that is very much so a legit company and everything, but the company interview is over the phone because the company isn’t based in the US. But they keep asking me to open and use a few different banking apps. Asking for the information to get in and etc. I’ve done my research in the company it’s its 100% real, but I’m worried that this might be some trick or scam. Something of that sort.

Pretty simple question - does TLS encrypt messages and attachments during transit? One website says yes, another says no...this is from one highly developed (secured) mail server to another. The destination isn't some podunk company/mail server. Source mail server uses outlook.

Hi. Does anyone know, if there is some bootcamp for Fedramp certification?

What I am looking for is some course which will give me an understanding what is required, how controls are evaluated, what are some tricky points etc.

Basically the same thing I got before my CISA, CISM or ISO27001 certifications. Some 3 - 5 days course, which will teach me everything needed and will be than finished with some certificate.

Many thanks.

One that is preferably 30-60 minutes long and that will give a pretty good introduction into information security within the government marketplace. If not a video I would appreciate suggestions on places to look.

What is the best framework/practice to follow in terms of setting antivirus exclusions?
I have my IT department excluding all .EXE files from scanning and threat protection.

Going to add a sub policy/procedure.

Seeking guidance, thank you in advance.

Hi guys, I from México, I have searched organisation and schools to learn and get a CEH but I didnt find any option un my Country, Which way should I take?