Evaluation of a person, organization, system, process, enterprise, project or product.

learn more… | top users | synonyms (1)

2
votes
2answers
90 views

Will the following PHP code result in source code info leak/disclosure?

I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php. So I went ahead to guard ...
2
votes
0answers
18 views

Finding Audit Reports and Results for Whole Disk Encryption Solutions

Due to TrueCrypt being pulled from the web even though it's been audited, I was asked to compare the audit of TrueCrypt against audits and information available for other products that do whole disk ...
2
votes
0answers
76 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
1
vote
1answer
41 views

Internal access to security sensitive data in a company

I'm building a software that requires a lot of security for the data. The user data in essence is very sensitive. So we are building a lot of encryption, 2 step authentication, app call tokenization ...
0
votes
1answer
51 views

Risk of temporarily unencrypted data during transmission between systems

I have encountered a situation where sensitive data files are saved unencrypted to server file directories temporarily for 1 to 30 minutes before being sent to a destination application. The data ...
0
votes
3answers
71 views

Exploiting a desktop application

I'm studying application security and now I have a question which I couldn't find a good answer. Assume I have a vulnerable desktop application in my virus-free windows 7 PC. Let's say when the file ...
0
votes
0answers
10 views

Categories for Information Security Learning [duplicate]

I'm learning Information Security, Actually I'm a software developer but for my work I need to learn a lot of Information Security, you know attacks and defenses, But I really don't know where to ...
1
vote
1answer
48 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
0
votes
0answers
23 views

How come UAC logs are not being stored in Event Viewer? [migrated]

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
0
votes
1answer
36 views

Can a security control be both management, technical and operational?

I know that security controls are divided into three categories, namely technical, management and operational. Going through them I always felt as a though a control belonging to one of the above ...
1
vote
0answers
68 views

Vetting new IT development staff [closed]

In the realm of software development what would be the best way to vet prospective employees? We handle potentially sensitive information, and a code base which could be potentially lucrative to ...
1
vote
1answer
55 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
5
votes
2answers
507 views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
0
votes
1answer
109 views

I just found many facebook entries on my registry? [closed]

I don't have a Facebook account but I was messing with my registry deleting old stuff and I found a bunch of Facebook keys and folders. Facebook is notorious for being a tool for spy agencies and has ...
1
vote
1answer
31 views

What is the relation between ANSI and ISO regarding ISO 27000?

So in one answer I was told that ANSI is a governing body (the only one in the world) for ISO 27000? I think I got something wrong, because I don't see ANSI mentioned anywhere when I read about ...
0
votes
2answers
83 views

What could be the scope of ISO 27000 standards?

If a company wants to certify against some of ISO 27000-series standards (let's say ISO 27001 and ISO 27005), what could possibly be certified? I mean, is it IT processes in general in the ...
1
vote
0answers
84 views

How secure is Jitsi VoIP/IM Android app? [closed]

I was looking for a FOSS end-to-end encrypted alternatives to Skype and came over Jitsi. It looks all nice and seems to work really well (at least clients on Linux and Android). Even cross-messaging ...
1
vote
2answers
35 views

Determining a version of SSH from penetration testing?

I am a software developer -- but not a security specialist. A (legitimate) company that does security scans sent my company a notice that we are running an older version of SSH on our hosting server. ...
2
votes
1answer
95 views

Is it common for all hard / USB drives to be accessible to everyone on a network?

Every PC can map to any other PC's hard drive(s) / USB drive(s) on the network where I work. When I realized this I thought it was odd. All one needs to do is access the (Start) button then type ...
0
votes
0answers
35 views

Questions to confirm a good standpoint on web app security?

What should be the questions asked to assess a company on web app security? Our company is in process of partnering with another company in order to outsource web app security work to them. For us ...
0
votes
0answers
32 views

Translating BUILTIN\Users Privileges and Security Settings

I would like to rid my CustomUsers security group from it's dependency on the BUILTIN\Users security group. My goal is to achieve the following: Tightened security (the OS is also hardened) Easy ...
1
vote
2answers
71 views

Using DNS to track browser activity on a LAN

I am trying to create a small network auditing script that tracks HTTP and HTTPS domain names visited by certain hosts using the libpcap wrapper for Nodejs. At its best the script would be able to ...
1
vote
2answers
210 views

Is SpiderOak truly “zero-knowledge”?

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to ...
3
votes
0answers
41 views

Open source tools to run generic audit of user entitlements? [closed]

Over the past years, my team has been asked to conduct audits/reviews for other teams. Most of these audits have been compliance-driven and almost all of them have followed the same format: some group ...
0
votes
0answers
28 views

Security audit framework of Internet Explorer Outlook Web Access (OWA) add-on?

I'm working with a software company that has developed an add-on to Outlook Web Access. They are aggregating data and providing a consolidated view of a particular topic / category. I have experience ...
4
votes
1answer
166 views

CentOS Security Tracker

Most Linux distros provide a page where you can check whether the latest package has any security vulnerabilities and what version they are fixed in. I understand that CentOS derives most of it's ...
0
votes
3answers
80 views

How to integrate AAA and otp

We have AAA services enabled in our organization (about 1000 clients). We want also to add otp (one time password) service. What are the main security concerns about integrating them. Is there any ...
1
vote
1answer
41 views

How do you determine if an open source script contains malicious code?

I am trying to analyze an open source auditing tool to determine if it makes unnecessary and potentially harmful changes to the system. I am interested in determining if the script calls any binaries ...
2
votes
0answers
174 views

Using “Security Compliance Manager” to audit a Windows system

I found a few posts which suggest using Microsoft SCM (Security Compliance Manager) to audit the security of Microsoft software solutions: Windows security policy analysis tool How do I apply a ...
2
votes
1answer
140 views

What question(s) can someone ask an individual to quickly determine their 'hacking ability'?

Scenario: You are on Craigslist searching for cheap electronics and come across an add for cheap E-reader. It's a bit of a deal with about 20-40% off the retail price so you contact the seller and all ...
0
votes
1answer
38 views

Workflow for changes to source code

How do you make sure that in your environment, you have proper controls of your source code. For example, before deployment of any application, there must be approval from the boss and other parties. ...
1
vote
0answers
525 views

Is Tox really secure? [closed]

There is a new Skype-killer application called Tox. They said that it's open source and that it protects its users against governments and other adversaries that try to collect your information. But ...
2
votes
0answers
28 views

How do I start securing a virtual appliance to avoid manipulation? [closed]

We have created an amateur software product related with monitoring and management of specific services. It has been made in Python and runs a web service as frontend to show the data in a nice way ...
3
votes
1answer
118 views

What documentation can I ask a vendor for to show HIPAA compliance

Over the past year, several vendors I've contracted with have claimed hipaa compliance. I have asked them for documentation of their compliance and I've never seen any. I would expect an audit ...
-1
votes
1answer
106 views

how to gain root access to linux machine? [closed]

I am a security auditor and I have faced the following situation: A development company that has a group of Linux machines gives limited access to their users. They asked me to find out all the ...
1
vote
0answers
14 views

Get information about the audit state of software (for OSS)?

How does one go about to determine how well audited/checked a software is? To make this a much more specific question I am interested in ways to ascertain (mailing lists, rankings etc.) that a ...
1
vote
1answer
94 views

what is an internal iso 27001 technical auditor? [closed]

i have been recently hired by an ISO 27001 certified company as an " internal ISO technical auditor". My employer told me that my job is described as follow: this job is created because of the need ...
23
votes
7answers
5k views

What stops a developer from accessing credit card details and other secret data from a company

First of all, I'm sorry if this has been discussed many times. I read many posts about PCI compliance but there are some small things I'm not quite sure about. Suppose there is Mr. GoodGuy, an ...
0
votes
1answer
106 views

SSID rotation prevent tracking or not?

The Program VirtualWifi Manager can rotate SSID's. Does rotating SSID's prevent the google tracking _nomap problem?
25
votes
6answers
2k views

How can security audits be integrated into an agile project?

If we give a security auditing company a working system, and ask them to audit it, and only do that once during a project because it's expensive, this is basically waterfall. How can security ...
0
votes
2answers
309 views

“Shell shock” - exploitable when `system()` syscall or `exec(bash)`, right?

Is my understanding correct that in order to exploit via "Shell Shock", binary we influence needs to execute bash (and we need to have influence on command line)? Therefore, am I correct, that if ...
3
votes
2answers
72 views

Any advice on how to assure patients that a medical facility is well protected against identity theft?

My apologies if this question has been asked before. How does a medical practice assure patients that the practice follows excellent computer security practices? Conversely, how does a patient find ...
2
votes
2answers
258 views

How can one secure Exchange 2010 cookies? [closed]

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an ...
0
votes
2answers
230 views

Is this hash function safe?

Below is the hash function implementation of the roguewave library. It returns a 32 bit hash. The core operation is A = B ^ ((C << 5) | (C >> 27)). Is this hash safe to use as a password check ...
1
vote
2answers
81 views

Information Security and Financial Risks

Recently, we've been asked by Audit Dpt. to have financial risks controls in our ERP (fraud-like incidents). Our question is if this request is covered by the scope of Information Security Dept? If ...
2
votes
2answers
158 views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
3
votes
3answers
722 views

Websites Forcing Weak Password Standards (Updated) [duplicate]

Please Note: I am not going to name the websites which have these horrible standards for their clients and users. I have had to change my passwords for my routine update just recently in the last ...
1
vote
3answers
166 views

In a company is it good to have a back door account?

Having a backdoor account (that is a username/password that can login in to an administrative account on all machines) can be very useful for IT staff. However, some believe it's a security breach. ...
2
votes
1answer
112 views

Auditing Event Logs of a System

Soon I will be acquiring the event logs of the systems my company produces and expected to audit them. Multiple logs are generated from each computer and there are multiple operating systems to audit. ...
3
votes
3answers
224 views

Trusting SSL and the Trust Chain

As we all know, when an SSL Certificate is assigned, there is a trust chain that is created for verify everyone from the Certificate Authority to the actual website's SSL Certificate. Thanks to a ...