User Mike B - Information Security Stack Exchange

94 votes

2 answers

84k views

What is the relationship between "SHA-2" and "SHA-256"

asked Apr 29, 2015 at 17:01

46 votes

2 answers

51k views

What is the difference between a "Thumbprint Algorithm" "Signature Algorithm" and "Signature Hash Algorithm" for a certificate?

asked Oct 20, 2014 at 20:31

31 votes

4 answers

95k views

What is the purpose/role of the "alias" attribute in Java keystore files?

asked May 23, 2016 at 5:16

23 votes

3 answers

10k views

What is the difference between "key length" and "bit strength"?

asked Oct 21, 2014 at 15:26

10 votes

3 answers

7k views

What's the difference between an access control method, security model, and security policy?

asked May 12, 2011 at 2:21

9 votes

3 answers

8k views

Why does the ★-property rule of the Bell-LaPadula Model allow information to be stored in objects with HIGHER sensitivity labels?

asked Apr 22, 2011 at 0:17

8 votes

1 answer

2k views

What is a practical example of an action that violates the non-interference model?

asked May 13, 2011 at 0:31

7 votes

3 answers

7k views

What's a practical example of encryption "in use" or "in process"?

asked Mar 27, 2018 at 14:38

6 votes

2 answers

927 views

What's the difference between "load testing" and "stress testing" within the context of a security audit?

asked Feb 20, 2018 at 15:47

6 votes

1 answer

3k views

Is it correct to consider Task Based Access Control as a type of RBAC?

asked May 3, 2011 at 0:22

5 votes

2 answers

267 views

Is it correct to consider audits as exclusively "detective" in nature?

asked May 5, 2011 at 0:37

4 votes

2 answers

3k views

How exactly are registration authorities related to certificate authorities?

asked Apr 25, 2017 at 23:45

4 votes

1 answer

461 views

Is there a difference in terminology between the words "cryptogram" and "ciphertext"?

asked Dec 29, 2017 at 19:07

4 votes

1 answer

3k views

Are Meltdown and Spectre exploitable on 32-bit Linux platforms?

asked Jan 5, 2018 at 0:47

3 votes

1 answer

5k views

What's the difference between an "application-aware firewall" and a "web application firewall"?

asked Apr 18, 2018 at 15:04

3 votes

2 answers

6k views

What's the difference between an API gateway and XML gateway?

asked Apr 19, 2018 at 14:34

3 votes

1 answer

1k views

Is there a difference between "Maximum Tolerable Downtime" and "Maximum Allowed Downtime"?

asked May 24, 2018 at 14:38

3 votes

1 answer

139 views

Are all (or most) expired certificates issued by 3rd party certificate authorities also marked as revoked?

asked Oct 24, 2017 at 22:59

3 votes

2 answers

1k views

Is there a difference between "risk tolerance" and "risk appetite"?

asked Jun 13, 2018 at 14:37

3 votes

3 answers

23k views

What's the difference between "Due Care" and "Due Diligence"?

asked Feb 16, 2017 at 0:42

3 votes

2 answers

556 views

What's a practical example of how volatile information can be preserved in a digital forensics investigation?

asked Mar 7, 2018 at 15:36

3 votes

1 answer

268 views

Why would a goal of DLP solution implementation include "loss of mitigation"?

asked Mar 28, 2018 at 15:03

3 votes

3 answers

941 views

How do I clearly distinguish between groups of formal and informal models?

asked May 18, 2011 at 0:11

3 votes

2 answers

293 views

Is there a difference between "symmetric algorithms" and "symmetric ciphers" within the context of cryptography?

asked Dec 29, 2015 at 22:54

2 votes

2 answers

2k views

Is a SHA-256 signature required on a CSR in order to generate a certificate with SHA-256 signature?

asked Nov 20, 2015 at 21:31

2 votes

2 answers

2k views

What's the difference between "access aggregation" and "authorization creep"?

asked May 6, 2017 at 14:46

2 votes

1 answer

344 views

Is it reasonable to consider logs as a "technical control"?

asked Jun 14, 2018 at 14:49

2 votes

1 answer

181 views

What's the difference between OVAL definitions, objects, and tests?

asked Jul 1, 2019 at 20:30

2 votes

1 answer

854 views

Does "crypto offloading" require the use of ASICs? Can the concept be applied elsewhere?

asked Apr 20, 2018 at 14:40

2 votes

2 answers

2k views

Do TLS standards require the server-side preference to always be used when negotiating ciphers to use?

asked May 9, 2018 at 0:35

Stack Exchange Network

60 Questions

What is the relationship between "SHA-2" and "SHA-256"

What is the difference between a "Thumbprint Algorithm" "Signature Algorithm" and "Signature Hash Algorithm" for a certificate?

What is the purpose/role of the "alias" attribute in Java keystore files?

What is the difference between "key length" and "bit strength"?

What's the difference between an access control method, security model, and security policy?

Why does the ★-property rule of the Bell-LaPadula Model allow information to be stored in objects with HIGHER sensitivity labels?

What is a practical example of an action that violates the non-interference model?

What's a practical example of encryption "in use" or "in process"?

What's the difference between "load testing" and "stress testing" within the context of a security audit?

Is it correct to consider Task Based Access Control as a type of RBAC?

Is it correct to consider audits as exclusively "detective" in nature?

How exactly are registration authorities related to certificate authorities?

Is there a difference in terminology between the words "cryptogram" and "ciphertext"?

Are Meltdown and Spectre exploitable on 32-bit Linux platforms?

What's the difference between an "application-aware firewall" and a "web application firewall"?

What's the difference between an API gateway and XML gateway?

Is there a difference between "Maximum Tolerable Downtime" and "Maximum Allowed Downtime"?

Are all (or most) expired certificates issued by 3rd party certificate authorities also marked as revoked?

Is there a difference between "risk tolerance" and "risk appetite"?

What's the difference between "Due Care" and "Due Diligence"?

What's a practical example of how volatile information can be preserved in a digital forensics investigation?

Why would a goal of DLP solution implementation include "loss of mitigation"?

How do I clearly distinguish between groups of formal and informal models?

Is there a difference between "symmetric algorithms" and "symmetric ciphers" within the context of cryptography?

Is a SHA-256 signature required on a CSR in order to generate a certificate with SHA-256 signature?

What's the difference between "access aggregation" and "authorization creep"?

Is it reasonable to consider logs as a "technical control"?

What's the difference between OVAL definitions, objects, and tests?

Does "crypto offloading" require the use of ASICs? Can the concept be applied elsewhere?

Do TLS standards require the server-side preference to always be used when negotiating ciphers to use?