December 2006
Back to Basics: Http Essentials
by Jose Varghese, CISSP, GSEC, GCIH, CBCP, BS7799 LA
In this article series, we will refresh through some of the basic concepts in HTTP. The first part of the series provides answers to a few questions on caching. It primarily addresses questions like what is stored in a cache, how is it stored and how to control their behaviour.… more →
Insecurities in Healthcare Applications
by Firosh Ummer, CISA
Online Healthcare applications come under the radar of HIPAA. In this article we discuss the threats they are exposed to, the attacks we’ve seen work against them and the precautions to take.… more →
Wireless Security - How WEP works
by Arvind Doraiswamy
As you probably already know Wired Equivalent Privacy (WEP) is used by companies to secure their wireless connections from sniffing attacks. You’ve probably also heard that it’s not very secure. In the first part of this 2 part series I’ll explain the inner workings of WEP and follow it up next month with why it’s insecure.… more →
Quiz: SSL handshake for multiple pages
Your Internet Banking site is fully SSL enabled. Login-page, Account summary page and Fund transfer page are all HTTPS enabled. When you bank online - login, check your account summary and do a fund transfer, is SSL authentication and handshake happening separately for each page or is it one handshake for all the three pages?
- HTTP is stateless, so is SSL. Full SSL handshake needed for each HTTP page.
- SSL is stateful, only one full handshake for multiple HTTP pages in a session.
- SSL is security at IP layer. One handshake for one set of source/destination IP address.