Details of the Inquiry The Log4j vulnerability is said to affect a very large number of products. How can we tell whether it affects our systems? Is there also a way to tell whether we have already been attacked? Only the important information is being shared on an urgent basis. Related vulnerabilities may continue to
Specific inquiry I am responsible for the technical side of information security at my company. The IT department has decided to develop information systems based on a microservice architecture.I have looked for related material, but most of it is conceptual. I am requesting help on the specific items I should present to the IT development
Details of the Inquiry Our company obtained PCI-DSS certification this year and, under its requirements, undergoes a penetration test every year.The penetration-test results reported an HTTPS TLS/SSL Cipher Suite vulnerability on the web server.When we check the actual status of the target web listener, the vulnerability does not appear to be present. The target in
How to implement data encryption with the server’s public key on a website that provides HTTPS? Occasionally, when diagnosing mock hacking on a mobile app or website, there are cases in which the data is encrypted with a random symmetric key method and transmitted to the server without encrypting the data using the
Details of the inquiry We want to add a simple chat function on the web. What should we consider from a security perspective? Security Considerations When Implementing WebSocket 1. Authentication mechanismApply an appropriate authentication mechanism in order to prevent WebSocket access by unauthorized parties. 2. Access ControlApply access control in an appropriate way so that
Details of the Inquiry I would like to turn an idea for a fintech business into a system.What information security requirements must be considered when developing a fintech system?Because we are a startup, are there guidelines for companies that find it difficult to obtain professional opinions such as consulting?If there are cases from other companies,
Specific inquiry We are a company that issues and manages electronic money. Most of the services we now intend to develop are located in the cloud.What are the relevant requirements we must comply with, including the Regulation on Supervision of Electronic Financial Transactions? Article 14-2 (Procedures for the Use of Cloud Computing Services, etc.) of
Details of the inquiry I am in charge of the development team at a company that provides a streaming service on the cloud in SaaS form.We have come to use UUIDs. Please tell us what security matters should be considered when designing or implementing them. 1. Security considerations 2. Python example of UUID generation #
Details of the inquiry I am in charge of development work at my company. We want to add an OAuth authentication function to a service we already operate.What should we consider from a security standpoint when designing or implementing it? Security considerations 1. Use encryption on communication paths.– Apply HTTP/TLS encryption (TLS 1.2 or higher)
Specific Inquiry I am responsible for information security at my company. I have been assigned information security responsibilities for an information system development project that the company is pursuing.I am requesting assistance because I want to know which authentication technologies can be considered in a distributed environment such as an MSA, and how they are