The Perfect Context
There was nothing unusual about the email. At least, that was how it looked to him.
Cybercrime: Malice in Everyday Life โ Part 3
... ReadThe Forgotten Door
The router had been working nonstop for years. No one had given it a second thought.
Cybercrime: Malice in Everyday Life โ Part 2
... ReadAn Email from Someone You Know
The email had not come from a stranger.
Cybercrime: Malice in Everyday Life โ Part 1
You don’t have to be someone special to be targeted.
... ReadIf Something Goes Wrong, What Should You Do First ?
Protecting Your Work and the Connections That Matter โ Part 6
What if something unusual happens during your usual work?
Imagine that you start work one morning and see an unfamiliar message on your computer.
... ReadYou Don't Have to Protect Everything at Once. Start with What You Can Do.
Protecting Your Work and the Connections That Matter โ Part 5
Where should you begin?
So far, we have looked at how our work depends on many people and services, and how a problem somewhere along those connections can affect the work itself.
... ReadProblems Can Come from Places You Don't Expect
Protecting Your Work and the Connections That Matter โ Part 4
An email from a business partner you know well
One day, you receive an email from a company you have worked with for a long time.
... ReadThe Problem Isn't Just Stolen Information
Protecting Your Work and the Connections That Matter โ Part 3
What if you could not do your usual work one morning?
Imagine opening your shop one morning.
... ReadYou Don't Do Your Work Alone โ โSupply chainโ
Protecting Your Work and the Connections That Matter โ Part 2
How a product reaches the customer
Imagine a small bakery.
... ReadIs That Wi-Fi Really Just for Your Customers ?
Protecting Your Work and the Connections That Matter โ Part 1
โCould we make Wi-Fi available to customers, too?โ
Imagine that this is how the idea of offering Wi-Fi at a small business begins.
... ReadIDS/IPS: What Executives and Managers Need to Understand to Protect Websites and APIs
IDS/IPS Is Installed: But Are You Actually Secure ? โ Part 2
Introduction: Installing Security Products Does Not Protect an Organization by Itself
- IDS: Intrusion Detection System
- IPS: Intrusion Prevention System
These systems monitor network traffic or system activity to identify signs of potentially malicious behavior. An IPS is intended to go a step further by taking preventive action, such as blocking traffic that matches a detection condition.
... ReadWhat Are IDS/IPS ? Lessons from Incidents
IDS/IPS Is Installed: But Are You Actually Secure ? โ Part 1
Introduction: Security Products Cannot Protect an Organization on Their Own
- IDS: Intrusion Detection System
- IPS: Intrusion Prevention System
These systems monitor network traffic or system activity to identify signs of potentially malicious behavior. An IPS is intended to go a step further by taking preventive action, such as blocking traffic that matches a detection condition.
... ReadWAF: What Executives and Managers Need to Understand to Protect Websites and APIs
WAF is useful, but it does not provide complete protection โ Part 2
Introduction: What Is a WAF ? A Checkpoint for Incoming Web Traffic
A WAF (Web Application Firewall) is a security function that inspects HTTP/HTTPS traffic reaching websites and Web APIs. It applies predefined rules to decide whether to allow, log, or block that traffic. A useful way to understand it is as a checkpoint placed in front of a website.
... ReadWhat Is a WAF ? Lessons from Incidents
WAF is useful, but it does not provide complete protection โ Part 1
Introduction: What Is a WAF ? A Checkpoint for Incoming Web Traffic
A WAF (Web Application Firewall) is a security function that inspects HTTP/HTTPS traffic reaching websites and Web APIs. It applies predefined rules to decide whether to allow, log, or block that traffic. A useful way to understand it is as a checkpoint placed in front of a website.
... ReadPHP End-of-Life Is a Business Risk: What โPHP2shellโ Reveals About Patch Responsibility
For websites, commercial services, and enterprise systems, support deadlines are not merely a technical concern. Leaving vulnerabilities unpatched is a management and operational challenge that can directly lead to business disruption, a loss of customer trust, and budgetary impact.
... ReadPart 4: Breaking Free from the 24/365 Constraint โ Maintenance Windows as a Management Decision
โWeb services are supposed to run continuously, 24 hours a day, 365 days a year.โ When did we start taking this for granted?
... ReadPart 3: The KISS Principle and Planned Downtime โ Reducing Complexity for Sustainable Operations
โWeb services are supposed to run continuously, 24 hours a day, 365 days a year.โ When did we start taking this for granted?
... ReadPart 2: Does a Restart Make a System Safe ? โ Designing for Recovery
โWeb services are supposed to run continuously, 24 hours a day, 365 days a year.โ When did we start taking this for granted?
... ReadPart 1: Is "Never Stopping" Really a Sign of Quality ?
โWeb services are supposed to run continuously, 24 hours a day, 365 days a year.โ When did we start taking this for granted?
... ReadIs 24/365 uptime worth the security risk ?
โWeb services are supposed to run continuously, 24 hours a day, 365 days a year.โ When did we start taking this for granted?
... Readjwt-encde 1.1: npm packages for cross-platform published
jwt-encde, local and fast GUI JWT encoder/decoder, 1.1 ๐ now supports installation via
npm๐คnpm install -g jwt-encde npx jwt-encdejwt-encde: A simple way to handle JWTs on your desktop
sudoedit (`sudo -e`) security flaw (CVE-2023-22809)
CVE vulnerabilities on Google Chrome prior to releases around on Dec. 2022
Symfony 6 and JWT bundles: Refresh token
Symfony 6 and EasyAdmin 4: Hashing password
Summary
With EasyAdmin bundle, you can create admin panel easily.
Well, as to User entity, given it has password field, you must want to hash it before it stored for security.
... ReadSymfony 6 and EasyAdmin 4: Admin Panel for User Management System
Symfony 6 User Authentication
A new RCE vulnerability on Log4j 2.17.0 (CVE-2021-4483)
Log4j 2.17.1 was released because a new vulnerability on RCE (Remote Code Execution) had been found in 2.17.0. (CVE-2021-4483)
According to The Apache Software Founndation, CVSS is 6.6 and the severity is moderate.
... ReadLog4j 2: New vulnerability on DoS in 2.16.0 and below
Log4j 2.17.0 was released due to security reason. It fixes DoS vulnerability in 2.16.0 and below on v2.
As to the new vulnerability on DoS (denial-of-service), it’s safe with a default Pattern Layout where a Context Lookup such as
... Read$${ctx:loginId}are NOT used in logging configuration. Otherwise, the CVSS score is 7.5 and the severity is high.New Log4j vulnerability was found in 2.15.0 which is less dangerous
About Apache Log4j RCE vulnerability (CVE-2021-44228)
Summary
- Caused by Apache Log4j’s JNDI (“Java Naming and Directory Interface”) features.
- How is it severe? The CVSS score is 10, the maximum, which means the highest risk.
Description
CVE-2021-44228 (named “log4shell” or “log4jam”): Remote code execution (RCE) severe vulnerability, discovered in Log4j, affects a wide range.
... ReadApache Log4j RCE vulnerability (CVE-2021-44228): Attack trials detected
Today, our company detected attack trials on Apache Log4j RCE vulnerability (CVE-2021-44228) due to its JNDI (“Java Naming and Directory Interface”) features to one of our servers in Swiss:
... Read
32 post(s) found.