https://community.aptible.com/t/identifying-users-in-an-aptible-ssh-context/194
https://security.stackexchange.com/questions/31024/encrypt-data-within-mobile-app-and-send-to-web-service
Some QA survey from https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/questionnaire/index.html?language=es
Docker Aptible nginx reveal open-ssl support (normally as linux support latest ?)
https://github.com/aptible/docker-nginx
SSL vs TLS
https://www.fastmail.com/help/technical/ssltlsstarttls.html
Mã hóa đường truyền khác j mã hóa data (content email chẳng hạn) ?
Vụ audit: có mã hóa mail authen ko ? (có => what version?)
TLS and/vs SSL
https://en.wikipedia.org/wiki/Transport_Layer_Security
http://frodo.looijaard.name/article/sendmail-using-tls-authentication
Sample network diagram
http://akioz.com/network-architecture-diagram/
There're many app to draw Net diagram. MS Visio can but not widely used ? So hard 2 find sample file ?
So much information about Bil Carson.
https://github.com/aptible/docker-nginx
HTTPS server support balanced security and compatibility with older clients SSL,TLS RC4 cipher ...
4 tier standard (Database server "quality")
https://www.colocationamerica.com/data-center/tier-standards-overview.htm
Version SSL server support ?
I know we can use openssl with -ssl3 option, something like this:
openssl s_client -connect chat.local:5222 -starttls xmpp -ssl3
https://security.stackexchange.com/questions/71457/how-can-i-verify-that-sslv3-protocol-is-disabled
Test ssl version available
http://thenubbyadmin.com/2014/02/17/how-can-i-determine-what-ssltls-versions-are-available-for-https-communication/
https://testssl.sh/
http://disablessl3.com/
http://stackoverflow.com/questions/26791107/websockets-wss-on-http-vs-wss-on-https
Man in middle can be attack HTTP transport. SSL, wss can not ?
Is a web socket secure (wss) connection still encrypted through TLS/SSL if the website/server is not?
Yes.
Are wss (Secure Web Socket) connections just as secure on an http server as they are on an https server?
Yes (see above). There is one thing to note: if the HTML/JavaScript that opens the secure WebSocket connection comes over non-secure HTTP, the WebSocket connection is still secure, but an attacker might modify the HTML/JavaScript while being sent from the Web server to browser. A HTTP connection isn't protected against man-in-the-middle sniffing or modification.
HITRUST
https://en.wikipedia.org/wiki/HITRUST
http://aapcperfect.s3.amazonaws.com/3f227f64-019f-488a-b5a2-e864a522ee71/93474f1d-58b3-4364-b060-790f48531f8a/71e98110-fafe-4880-8449-bddfbef5efa6.pdf
https://news.ycombinator.com/item?id=10197900
http://catalyzeio.github.io/policies/
VII. Data Security: Data Centers
A data center is a facility used to house mission critical computer systems and associated components. It generally includes environmental controls (air conditioning, fire suppression, etc.), redundant/backup power supplies, redundant data communications connections, and high security. Data centers containing confidential information should adhere to one of the four data center tiers defined by the Uptime Institute. No detail is required for CUSTOMER data centers.
http://www.datacenterknowledge.com/archives/2011/09/27/why-data-centers-need-ssae-16/
ssl suck 2 or 3
https://superuser.com/questions/246074/ssl-whats-the-reason-for-disabling-ssl-v2-support
How can I modify the way my app handles SSL?
Aptible endpoints use an AWS Elastic Load Balancer and an Nginx proxy to terminate SSL for all requests.
We offer a few ways to configure the way your app handles SSL by forwarding certain environment variables from your Aptible app configuration to the load balancer and proxies
https://security.stackexchange.com/questions/31024/encrypt-data-within-mobile-app-and-send-to-web-service
Some QA survey from https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/questionnaire/index.html?language=es
Docker Aptible nginx reveal open-ssl support (normally as linux support latest ?)
https://github.com/aptible/docker-nginx
SSL vs TLS
https://www.fastmail.com/help/technical/ssltlsstarttls.html
Mã hóa đường truyền khác j mã hóa data (content email chẳng hạn) ?
Vụ audit: có mã hóa mail authen ko ? (có => what version?)
TLS and/vs SSL
https://en.wikipedia.org/wiki/Transport_Layer_Security
http://frodo.looijaard.name/article/sendmail-using-tls-authentication
Sample network diagram
http://akioz.com/network-architecture-diagram/
There're many app to draw Net diagram. MS Visio can but not widely used ? So hard 2 find sample file ?
So much information about Bil Carson.
https://github.com/aptible/docker-nginx
HTTPS server support balanced security and compatibility with older clients SSL,TLS RC4 cipher ...
4 tier standard (Database server "quality")
https://www.colocationamerica.com/data-center/tier-standards-overview.htm
Version SSL server support ?
I know we can use openssl with -ssl3 option, something like this:
openssl s_client -connect chat.local:5222 -starttls xmpp -ssl3
https://security.stackexchange.com/questions/71457/how-can-i-verify-that-sslv3-protocol-is-disabled
Test ssl version available
http://thenubbyadmin.com/2014/02/17/how-can-i-determine-what-ssltls-versions-are-available-for-https-communication/
https://testssl.sh/
http://disablessl3.com/
http://stackoverflow.com/questions/26791107/websockets-wss-on-http-vs-wss-on-https
Man in middle can be attack HTTP transport. SSL, wss can not ?
Is a web socket secure (wss) connection still encrypted through TLS/SSL if the website/server is not?
Yes.
Are wss (Secure Web Socket) connections just as secure on an http server as they are on an https server?
Yes (see above). There is one thing to note: if the HTML/JavaScript that opens the secure WebSocket connection comes over non-secure HTTP, the WebSocket connection is still secure, but an attacker might modify the HTML/JavaScript while being sent from the Web server to browser. A HTTP connection isn't protected against man-in-the-middle sniffing or modification.
HITRUST
https://en.wikipedia.org/wiki/HITRUST
http://aapcperfect.s3.amazonaws.com/3f227f64-019f-488a-b5a2-e864a522ee71/93474f1d-58b3-4364-b060-790f48531f8a/71e98110-fafe-4880-8449-bddfbef5efa6.pdf
https://news.ycombinator.com/item?id=10197900
http://catalyzeio.github.io/policies/
VII. Data Security: Data Centers
A data center is a facility used to house mission critical computer systems and associated components. It generally includes environmental controls (air conditioning, fire suppression, etc.), redundant/backup power supplies, redundant data communications connections, and high security. Data centers containing confidential information should adhere to one of the four data center tiers defined by the Uptime Institute. No detail is required for CUSTOMER data centers.
ssl suck 2 or 3
https://superuser.com/questions/246074/ssl-whats-the-reason-for-disabling-ssl-v2-support
How can I modify the way my app handles SSL?
Aptible endpoints use an AWS Elastic Load Balancer and an Nginx proxy to terminate SSL for all requests.
We offer a few ways to configure the way your app handles SSL by forwarding certain environment variables from your Aptible app configuration to the load balancer and proxies
Comments
Post a Comment