http___hr.ahoooj.com__1.xml
1.1 1.2 2.1 2.2 2.3 2.4 2.5 3.1 3.2 4.1 5.1 6.1 6.2 6.3 6.4 6.5 6.6 6.7 7.1 8.1 9.1 9.2 10.1 11.1 12.1 12.2 12.3 12.4 12.5 13.1 14.1 15.1 15.2 16.1 17.1 18.1 18.2 18.3 18.4 19.1 20.1 21.1 22.1 23.1
Three Web Application Security Lessons To Keep In Mind. Semalt Expert Knows How To Avoid Becoming A Victim Of Cyber Criminals In 2015, the Ponemon Institute released findings from a study "Cost of Cyber Crime", which they had conducted. It came as no surprise that the cost of cyber crime was increasing. However, the figures were stuttering. Cybersecurity Ventures (global conglomerate) projects that this cost will hit $6 trillion per year. On average, it takes an organization 31 days to bounce back after a cyber crime with the cost of remediation at about $639 500. Did you know that denial of service (DDOS attacks), web based breaches and malicious insiders make up for 55% of all cyber crime costs? This not only poses a threat to your data but also could make you lose revenue. Frank Abagnale, the Customer Success Manager of Semalt Digital Services, offers to consider the following three cases of breaches made in 2016. First case: Mossack-Fonseca (The Panama Papers) The Panama Papers scandal broke into the limelight in 2015, but because of the millions of documents that had to be sifted through, it was blown in 2016. The leak revealed how politicians, wealthy businessmen, celebrities and the creme de la creme of society stored their money in offshore accounts. Often, this was shady and crossed the ethical line. Although Mossack-Fonseca was an organization that specialized in secrecy, its information security strategy was nearly non-existent. For a start, the WordPress image slide plugin they used was outdated. Secondly, they used a 3-year old Drupal with known vulnerabilities. Surprisingly, the organization's system administrators never resolve these issues. Lessons: - > always ensure that your CMS platforms, plugins and themes are regularly updated. - > stay updated with the latest CMS security threats. Joomla, Drupal, WordPress and other services have databases for this. - > scan all plugins before you implement and activate them Second case: PayPal's profile picture Florian Courtial (a French software engineer) found a CSRF (cross site request forgery) vulnerability in PayPal's newer site, PayPal.me. The global online payment giant unveiled PayPal.me to facilitate faster payments. However, PayPal.me could be exploited. Florian was able to edit and even removed the CSRF token thereby updating the user's profile picture. As it was, anybody could impersonate someone else by getting their picture online say for example from Facebook. Lessons: - > avail unique CSRF tokens for users – these should be unique and change whenever the user logs in. - > token per request – other than the point above, these tokens should also be made available when the user requests for them. It provides additional protection. - > timing out – reduces the vulnerability if the account remains inactive for some time. Third case: The Russian Foreign Affairs Ministry Faces an XSS Embarrassment While most web attacks are meant to wreak havoc to an organization's revenue, reputation, and traffic, some are meant to embarrass. Case in point, the hack that never happened in Russia. This is what happened: an American hacker (nicknamed the Jester) exploited the cross site scripting (XSS) vulnerability that he saw on Russia's Foreign Affairs ministry website. The jester created a dummy website that mimicked the outlook of the official website except for the headline, which he customized to make a mockery of them. Lessons: - > sanitize the HTML markup - > do not insert data unless you verify it - > use a JavaScript escape before you enter untrusted data in the language's (JavaScript) data values - > shield yourself from DOM based XSS vulnerabilities
1.1 2.1 2.2 2.3 2.4 2.5 3.1 4.1 5.1 5.2 5.3 5.4 5.5 5.6 5.7 5.8 5.9 5.10 6.1 7.1 7.2 8.1 9.1 9.2 9.3 10.1 11.1 11.2 11.3 12.1 13.1 13.2 13.3
Semalt: 5 vitalnih savjeta o tome kako se suprotstaviti lažnim prijevarama i neželjenoj pošti Otprilike 1,6 milijardi bita neželjene pošte e-pošte šalje se svakodnevno u cijelom svijetu. Procjenjuje se da 20 posto e-poruka koje vam šalju neželjenu poštu. U Sjevernoj Americi moguće je pratiti izvor 80% neželjene pošte jer se zna da potječu od 200 popularnih neželjenih poruka. Neželjena pošta zabrinjava jer čini osnovu na kojem se mogu pokrenuti lažni napadi. Phishing rizikuje da uzvratite račun i svoj identitet, a neželjena pošta obično smeta. Oliver King, menadžer uspjeha korisnika Semalta , razrađuje sljedeće pristupe pomoću kojih se možete zaštititi od neželjene pošte. Otvorite više adresa e-pošte. Prvo postavite osobnu adresu e-pošte i ograničite njezinu upotrebu na osobnu prepisku na nekoliko obitelji i prijatelja. U većini slučajeva spameri grade popise e-pošte spajajući uobičajena imena, brojeve i riječi. Dakle, onoliko koliko biste željeli koristiti prezime i ime u svojoj adresi e-pošte, preporučljivo je biti kreativan i odabrati jedinstvenu kombinaciju znakova. U prvom redu, pojedincu želite otežati dobivanje vaše osobne adrese e-pošte. Sada otvorite javnu adresu e-pošte i koristite je u situacijama koje zahtijevaju da se pretplatite na internetske usluge ili se registrirate na forumu. Pokušajte usvojiti sljedeće mjere sa svojom javnom adresom e-pošte. Promijenite ga često. Koristite brojne javne adrese e-pošte. Ova dva poteza pomoći će vam da znate tko odaje vašu adresu e-pošte potencijalnim neželjenim poštarinama. Nakon određivanja web lokacija ili platformi koje prodaju vašu adresu e-pošte, savjetujemo vam da ih izbjegavate i da prijavite Googleu. Nikada ne odgovarajte na bilo kakvu neželjenu poštu. Većina neželjenih pošiljaka potvrđuje odgovore i potvrde na svoje neželjene adrese e-pošte s ciljem utvrđivanja izvedbe. To znači da što više odgovarate na ove poruke e-pošte, veće su šanse da će se povećati broj neželjene pošte. Razmislite prije nego što se odlučite na pretplatu. Otkriveno je da spameri sada šalju lažne e-poruke za odjavu koje dominiraju s lažnim vezama za odjavu. Trikovi funkcioniraju u njihovu korist osiguravajući da se jednom kada kliknete "odjavi" pretplatu povećava količina primljene neželjene pošte. Ako poruka e-pošte dolazi iz nepoznatog izvora i traži od vas da se odjavite, savjetujete se da se oduprete porivu. Provjerite je li vaš preglednik ažuriran. Programeri preglednika često ažuriraju ove aplikacije kako bi osigurali da su sve trenutne sigurnosne zakrpe na mjestu. Neuspjeh u ažuriranju preglednika otkriva vaše računalo zlonamjernom softveru ili programskim pogreškama koje mogu prikupiti vaše osobne podatke i poslati ih neželjenoj pošti. Savjetujemo vam da osigurate da vaš gumb za automatsko ažuriranje uvijek bude u pokretu kako biste zaštitili svoje podatke. Uložite u filtre protiv neželjene pošte. Osigurajte da davatelj vašeg računa e-pošte ima brojne značajke za zaštitu od neželjene pošte. Gmail od Googlea ima mapu neželjene pošte u kojoj automatski filtrira e-poštu za koju pretpostavlja da je neželjena pošta dospjela u vašu pristiglu poštu. Ovo služi za smanjenje neugodnosti koju stvara neželjena pošta, posebno kada pronađu put do primarne pošte.