The search giant's efforts to become a viable alternative for enterprises looking to store and manage their data in the cloud will largely be determined by its ability to provide ironclad security.
A study shows that while most SMBs worry about small business computer security, they have no idea how to prevent it or how to protect themselves from bank fraud and identity theft.
Increasingly, security is becoming more about meeting the needs of the business and less about building a fortress. Using and applying meaningful metrics is critical first step.
Microsoft issued a security advisory on Thursday for a vulnerability in two SharePoint products....Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.
Microsoft and Adobe are working together on the security patch process....Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.
A pair of high-profile security and privacy breaches involving two of the world's most important technology companies has the FCC and FBI calling for action.
While enterprise security spends its time worrying about network-based attacks, the number of data breaches chalked up to Web applications continues to grow. Are you fighting yesterday's battles, too?
While enterprise security spends its time worrying about network-based attacks, the number of data breaches chalked up to Web applications continues to grow. Are you fighting yesterday's battles, too?
We are worried about the security of our website containing the login-button to our saas-application.
Security measures put in place for our application won't do us much good if the website is hacked. The login button could be redirected to some malicious copy of our app.
The product website is maintained by people outside the dev team. Those people are not too knowledgable concerning security.
We (dev-team) could mantain the website ourselves but that would be a large burden on our small team.
How is this usually handled?
I am trying to use a WCF client to call a third party web service.
The web Service usses username token authentication WSS-Security 1.0 Soap Message Security
Here is a sample soap authentication header for what the web service expects
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<wsse:Security soap:mustUnderstand="1">
<wsse:UsernameToken namespaces>
<wsse:Username>username</wsse:Username>
<wsse:Password Type="type info">password</wsse:Password>
<wsse:Nonce>nonce</wsse:Nonce>
<wsu:Created>date created</wsu:Created>
</wsse:UsernameToken>
<wsse:Security>
</soap:Header>
<soap:Body>
<WebServiceMethodName xmlns="Web Service Namespace" />
I configured the client to the following way
<basicHttpBinding>
<binding name="Binding1">
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="Basic"/>
</security>
</basicHttpBinding>
but recieved an error that stating that the nonce and datecreated attributes were missing in the header. Does anyone know how to configure a WCF client to work with
WSS-Security 1.0 Soap Message Security username token authentication?
Has anyone in the stackoverflow community ever studied the security characteristics of various J2EE frameworks? I would love to understand what framework best aligns with the Web Application Security Framework Manifesto http://labs.securitycompass.com/papers/secure-web-application-framework-manifesto-v0-08.pdf
In this case security means building security (access control, alarm systems, etc). And I am not talking about working directly with the hardware, more focused on web based applications/api's that clients or companies can use?
Are there technologies that are commonly used? Are there technologies that shouldn't be used? Are there any real benefits to a linux based stack as opposed to a windows based stack for exposing web based applications?
I have a spring TextEncryptor defined like this
<bean id="textEncryptor" class="org.springframework.security.crypto.encrypt.Encryptors"
factory-method="text">
<constructor-arg value="${security.encryptPassword}" />
<constructor-arg value="${security.encryptSalt}" />
</bean>
Which is fed these properties
security.encryptPassword=47582920264f212c566d5e5a6d
security.encryptSalt=39783e315e6a207e733d6f4141
Which works fine on my local environment. When I deploy to Heroku I get
java.lang.IllegalArgumentException: Unable to initialize due to invalid secret key
at org.springframework.security.crypto.encrypt.CipherUtils.initCipher(CipherUtils.java:110)
at org.springframework.security.crypto.encrypt.AesBytesEncryptor.encrypt(AesBytesEncryptor.java:65)
at org.springframework.security.crypto.encrypt.HexEncodingTextEncryptor.encrypt(HexEncodingTextEncryptor.java:36)
...
Caused by: java.security.InvalidKeyException: Illegal key size
at javax.crypto.Cipher.checkCryptoPerm(Cipher.java:972)
at javax.crypto.Cipher.implInit(Cipher.java:738)
at javax.crypto.Cipher.chooseProvider(Cipher.java:797)
at javax.crypto.Cipher.init(Cipher.java:1276)
at javax.crypto.Cipher.init(Cipher.java:1215)
at org.springframework.security.crypto.encrypt.CipherUtils.initCipher(CipherUtils.java:105)
... 53 more
So I tried some smaller keys but I always get the same problem. What is the correct key size to use on Heroku?
I've exposed several web services in our product using java and WS-Security. One of our customers wants to consume the web service using Coldfusion. Does coldfusion support ws-security? Can I get around it by writing a java client and using that in coldfusion?
(I don't know much about coldfusion).
I am trying to sign a token object using SHA1.
I am using bouncycastle as the security provider.
Whenever the program tries to sign something it gives me this error.
java.security.SignatureException: java.lang.IllegalArgumentException: input data too large.
What is the maximum size for signing something?
Do you have any suggestions about how I can sign this object?
Are there any security issues keeping the .NET PDB files on the real server?
I know that throwing exceptions might take a bit longer , but who throws exceptions during normal execution anyway? :-)
But from a security perspective? any issues?
Hi everyone,
I have changed the Configure::write('Security.salt', '############'); value in the file
config/core.php
file to a '256-bit hex key'. Is it safe or a good practice to change these lines for every different installation of cakephp application or shall I revert back to the original ?
I also changed the Configure::write('Security.cipherSeed','7927237598237592759727'); to a different one of more length.
Please throw some light on this.
Thanks