Development

2014: The toughest year for cryptographic web protocols

Security errors SSL (along with its TLS evolution) is the most used cryptographic protocol in its different implementations to guarantee the confidentiality of communications on Internet. This is achieved by ciphering, via asymmetrical cryptography algorithms, the communications between the client (usually the user’s web browser) and the server it gains access to. When a website is shown using...

Tags:

Cryptography

Vulnerability

SELinux and Mandatory Access Control

In a previous article about basic access control mechanisms in systems security we introduced Mandatory Access Control (MAC) as a more accurate mechamism than basic access control. Now we are talking about of SELinux as an example of Mandatory Access Control.

Tags:

Best practices

Linux

Vulnerability

Basic Access control mechanisms in Systems Security

<p>In any IT system, especially if it’s multiuser, the access control of users and resources is fundamental for its security. That’s why it’s very important to have mechanisms that provide an appropriate segregation of privileges and user permissions, along with the administration of these and related elements.</p>

Tags:

Best practices

Merovingio: Deceiving Malware

At the most recent Navaja Negra conference held in Albacete on 2, 3, and 4 October, I had an opportunity to present a tool that INCIBE has been working on for months. This tool, Merovingio is an applications analyser that determines whether these are legitimate or malicious.

Tags:

Malware

Cybercamp Security Challenges

Among the activities INCIBE has organised for the CyberCamp event to find new cyber-security talents are a wide range of Security Challenges which you can take part in to find out what it is that really fires your inspiration. The challenges are made up of two stages, one online and the other at the event itself. You can take part in the online stage, which will be open from 7 to 16 November ...

Tags:

CyberCamp: Show off Your Potential

One of the activities included in the Plan for Trust in Digital Life (Plan de Confianza en el Ámbito Digital) is the celebration of an event aimed at focusing the interest of all audiences towards this discipline, so important in our daily lives. The venue, organised by INCIBE will take place from 5 to 7 December, 2014, and will be held in the Pabellón Multiusos I of Madrid. As we want this...

Tags:

OWASP Testing Guide v4.0. A Guide to Security in Web Applications

The OWASP Foundation has updated its safety guide development, OWASP 4.0. Work of free distribution of high quality and prestige is already a reference for developers and auditors in the development of secure web applications. The OWASP foundation updates His guide to web development security, OWASP 4.0.

Tags:

Safe development

Use and Abuse of DNS

DNS is a protocol present in almost all network communications and therefore very attractive as a tool of attack and / or distribute malicious software such as viruses, botnets and malware. In this article some both offensive and defensive strategies based on the use of DNS are briefly outlined.

Tags:

Best practices

Data protection

Incident

The issue of biometrics as an authentication method

With the announcement of the new fingerprint sensor in the latest smartphone from Apple, the iPhone 5S, biometric sensors are again under scrutiny among information security professionals. Especially because the use of these technologies is becoming popular for consumer grade electronics, and its use use could become ubiquitous for something made to protect sensitive data, like information...

Tags: