Evaluation of a person, organization, system, process, enterprise, project or product.

learn more… | top users | synonyms (1)

0
votes
0answers
1 view

Tracking file deletion using auditd without unlink?

I'm working on creating an auditd rule that will track the deletion of files and directories. I have one that often turns up in online searches but I'm not sure it is really all that useful: -a ...
0
votes
2answers
76 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
0
votes
1answer
55 views

Is it safe to check if device is subject to Stagefright bug? [closed]

Is it safe to check if device is subject to Stagefright bug, for example with: Stagefright Detector App forAndroid by Zimperium ? Is such (or similar test) sufficient? Is there available any 3rd ...
4
votes
1answer
78 views

Protect password/authenticating during transit over (insecure) TCP socket for a game

Background I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join. The server has a ...
4
votes
2answers
108 views

How can I verifiably demonstrate that steganography or hidden partitions do not exist?

I want to verifiably demonstrate that there are no hidden partitions, or hidden messages in a given message. In this scenario, assume the subject is being monitored (consensually) and agrees to align ...
0
votes
1answer
66 views

How secure are the passwords stored at Google Passwords? [closed]

It seems Google activated central place for storing app/website passwords which is accessible at https://passwords.google.com/ and all the remembered Chrome passwords are synched there. In what ...
-4
votes
3answers
76 views

Does MEGA cloud service say ALL the truth? [closed]

If this is not the right community for this question please inform me where to ask :-) I am talking about: encryption no enceyption key kept by MEGA and so on. I found many reviews confirming ...
1
vote
2answers
184 views

Will hacking (pentesting) a live website from a VM improve or hinder my hacker anonymity?

Would a pentest initiated from a VM mounted on hard drive be more or less anonymous to IDS attack or forensically traceable? Please note: I will be browsing via tor and kproxy and have all that ...
-3
votes
1answer
68 views

What are any risks associated with being associated with potentially subversive software? [closed]

I have been doing a little research regarding software security. One of the ideas I came across is searching for or downloading some software such as Tor or TAILS will amend you to a government list. ...
1
vote
0answers
46 views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
1
vote
1answer
27 views

Security Assessment v/s Security Engagement Breakdown [closed]

I had this couple of threads in here which talks about security assessment v/s risk assessments, but here the idea is completely different. Suppose, I had to breakdown qualitative tasks from the ...
1
vote
1answer
81 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
1
vote
2answers
86 views

Performing a vulnerability assessment on Windows Tablets?

How does a security auditor perform a vulnerability assessment for Windows Tablets including Surface RT tablets deployed ones and any management application that comes pre-installed with it? Also, ...
2
votes
1answer
75 views

What is an ITGC Audit?

I don't get the purpose of such an audit especially given the way it is conducted. We have a 3rd party auditor who I won't name, but let's just say they probably audit the majority of the publicly ...
0
votes
0answers
39 views

Strange SECCOMP entries for sshd in audit log

I've posted this over at ServerFault but haven't received a response over there. I'm not a security professional, but I'm curious as to what kind of attack this might be and how the attackers might be ...
1
vote
0answers
33 views

Nessus Windows Compliance Check Issue [closed]

My team and I have been trying to troubleshoot an issue we have had with the Windows compliance check not working for a custom audit. We have enabled firewall and printer connections, tried disabling ...
4
votes
3answers
83 views

How to check that passwords are not stored in a readable format

I'm writing a plan to audit my password policy, and I was stuck on one of my policy controls which was making sure that No password should be stored in a readable format. What is the best practice ...
0
votes
2answers
74 views

Precauations for web application security audit

We have planned to give our web application to a third party vendor,what were the precautionary measures which we need to take care before giving our application to third party vendor? As the vendor ...
0
votes
2answers
273 views

NIDS/NIPS vs HIDS/HIPS

Can we interchangeably deploy a HIDS or HIPS instead of a NIDS/NIPS, what would be the risks, for example you have Symanetec EPS modules with HIPS policies enabled how are they different from a ...
-4
votes
1answer
70 views

How do you deal with personal security issues? [closed]

How do you deal with personal security issues? Let's say you've got reason to assume somebody with big capital may be trying to track your moves. Early in the morning, day after confrontation, you ...
0
votes
1answer
29 views

Advice needed regarding “Information Security Policy” - EI3PA requirements

Our new startup is required to jump through hoops in order to get authorization to use Experian. We are working out of WeWork (shared space). No experian data is stored on our local machines. We do ...
2
votes
2answers
195 views

Will the following PHP code result in source code info leak/disclosure?

I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php. So I went ahead to guard ...
2
votes
0answers
38 views

Finding Audit Reports and Results for Whole Disk Encryption Solutions

Due to TrueCrypt being pulled from the web even though it's been audited, I was asked to compare the audit of TrueCrypt against audits and information available for other products that do whole disk ...
2
votes
0answers
93 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
1
vote
1answer
54 views

Internal access to security sensitive data in a company

I'm building a software that requires a lot of security for the data. The user data in essence is very sensitive. So we are building a lot of encryption, 2 step authentication, app call tokenization ...
0
votes
1answer
93 views

Risk of temporarily unencrypted data during transmission between systems

I have encountered a situation where sensitive data files are saved unencrypted to server file directories temporarily for 1 to 30 minutes before being sent to a destination application. The data ...
0
votes
3answers
96 views

Exploiting a desktop application

I'm studying application security and now I have a question which I couldn't find a good answer. Assume I have a vulnerable desktop application in my virus-free windows 7 PC. Let's say when the file ...
0
votes
0answers
12 views

Categories for Information Security Learning [duplicate]

I'm learning Information Security, Actually I'm a software developer but for my work I need to learn a lot of Information Security, you know attacks and defenses, But I really don't know where to ...
1
vote
1answer
78 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
0
votes
1answer
83 views

Can a security control be both management, technical and operational?

I know that security controls are divided into three categories, namely technical, management and operational. Going through them I always felt as a though a control belonging to one of the above ...
1
vote
0answers
75 views

Vetting new IT development staff [closed]

In the realm of software development what would be the best way to vet prospective employees? We handle potentially sensitive information, and a code base which could be potentially lucrative to ...
1
vote
1answer
219 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
6
votes
2answers
4k views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
0
votes
1answer
129 views

I just found many facebook entries on my registry? [closed]

I don't have a Facebook account but I was messing with my registry deleting old stuff and I found a bunch of Facebook keys and folders. Facebook is notorious for being a tool for spy agencies and has ...
6
votes
1answer
90 views

Software can be audited, is there an equivalent for hardware?

In software, code auditing can be used as a mean to gain trust into a software. Of course closed, proprietary software would complicate this, and require to do reverse engineering. Anyway there seems ...
1
vote
1answer
37 views

What is the relation between ANSI and ISO regarding ISO 27000?

So in one answer I was told that ANSI is a governing body (the only one in the world) for ISO 27000? I think I got something wrong, because I don't see ANSI mentioned anywhere when I read about ...
0
votes
2answers
199 views

What could be the scope of ISO 27000 standards?

If a company wants to certify against some of ISO 27000-series standards (let's say ISO 27001 and ISO 27005), what could possibly be certified? I mean, is it IT processes in general in the ...
1
vote
0answers
195 views

How secure is Jitsi VoIP/IM Android app? [closed]

I was looking for a FOSS end-to-end encrypted alternatives to Skype and came over Jitsi. It looks all nice and seems to work really well (at least clients on Linux and Android). Even cross-messaging ...
1
vote
2answers
84 views

Determining a version of SSH from penetration testing?

I am a software developer -- but not a security specialist. A (legitimate) company that does security scans sent my company a notice that we are running an older version of SSH on our hosting server. ...
2
votes
1answer
104 views

Is it common for all hard / USB drives to be accessible to everyone on a network?

Every PC can map to any other PC's hard drive(s) / USB drive(s) on the network where I work. When I realized this I thought it was odd. All one needs to do is access the (Start) button then type ...
0
votes
0answers
56 views

Questions to confirm a good standpoint on web app security?

What should be the questions asked to assess a company on web app security? Our company is in process of partnering with another company in order to outsource web app security work to them. For us ...
0
votes
0answers
67 views

Translating BUILTIN\Users Privileges and Security Settings

I would like to rid my CustomUsers security group from it's dependency on the BUILTIN\Users security group. My goal is to achieve the following: Tightened security (the OS is also hardened) Easy ...
1
vote
2answers
103 views

Using DNS to track browser activity on a LAN

I am trying to create a small network auditing script that tracks HTTP and HTTPS domain names visited by certain hosts using the libpcap wrapper for Nodejs. At its best the script would be able to ...
1
vote
2answers
456 views

Is SpiderOak truly “zero-knowledge”?

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to ...
3
votes
0answers
65 views

Open source tools to run generic audit of user entitlements? [closed]

Over the past years, my team has been asked to conduct audits/reviews for other teams. Most of these audits have been compliance-driven and almost all of them have followed the same format: some group ...
0
votes
0answers
33 views

Security audit framework of Internet Explorer Outlook Web Access (OWA) add-on?

I'm working with a software company that has developed an add-on to Outlook Web Access. They are aggregating data and providing a consolidated view of a particular topic / category. I have experience ...
4
votes
1answer
214 views

CentOS Security Tracker

Most Linux distros provide a page where you can check whether the latest package has any security vulnerabilities and what version they are fixed in. I understand that CentOS derives most of it's ...
0
votes
3answers
138 views

How to integrate AAA and otp

We have AAA services enabled in our organization (about 1000 clients). We want also to add otp (one time password) service. What are the main security concerns about integrating them. Is there any ...
1
vote
1answer
58 views

How do you determine if an open source script contains malicious code?

I am trying to analyze an open source auditing tool to determine if it makes unnecessary and potentially harmful changes to the system. I am interested in determining if the script calls any binaries ...
2
votes
0answers
317 views

Using “Security Compliance Manager” to audit a Windows system

I found a few posts which suggest using Microsoft SCM (Security Compliance Manager) to audit the security of Microsoft software solutions: Windows security policy analysis tool How do I apply a ...