From the course: Threat Modeling: Spoofing In Depth
Join today to access over 22,500 courses taught by industry experts or purchase this course individually.
Defenses with extra fail
From the course: Threat Modeling: Spoofing In Depth
Defenses with extra fail
- There are a few defenses against spoofing that are simple, elegant and wrong. In defending against spoof files, these include hidden directories and files with random names. Take a moment. Pause the video. Think about why those don't work. There's more than one answer, but the core answer is that a hidden directory is obscurity. Once I know it's there, the defense doesn't work anymore. Compare that to create a directory, set its permissions, then create a file with the right permissions. While it sounds better, it's still technically risky. As I drafted this content, I realized there's a raised condition while I'm setting the permissions. I'm exposing that to show you that precision is important and even experts can make mistakes while being conversational or informal. So really, I'd set my permission's umask, then create the directory. I can know that there's a directory that's Mode 700 and files in it are writeable only by group threat modeling and it does me, the attacker, no…
Download courses and learn on the go
Watch courses on your mobile device without an internet connection. Download courses using your iOS or Android LinkedIn Learning app.