Evaluation of a person, organization, system, process, enterprise, project or product.

learn more… | top users | synonyms (1)

-1
votes
0answers
38 views

How to audit an Active Directory only knowing its IP address? [on hold]

Is it possible to audit an Active Directory only knowing its IP address? In my job, they provide me with the Active Directory IP addresses and ask me to check whether the passwords issued by the ...
1
vote
1answer
14 views

Security Assessment v/s Security Engagement Breakdown [on hold]

I had this couple of threads in here which talks about security assessment v/s risk assessments, but here the idea is completely different. Suppose, I had to breakdown qualitative tasks from the ...
1
vote
1answer
67 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
-1
votes
0answers
53 views

Do you know any tip to accomplish this xss? [closed]

I have the following scenario: Test A: https://target/srv;?q=pwn%0Aalert(1);//&ref=B The result: <script type="text/javascript"> if ("pwn alert(1);//" != "") ...
1
vote
1answer
31 views

Performing a vulnerability assessment on Windows Tablets?

How do a security auditor can perform a vulnerability assessment for Windows Tablets including Surface RT tablets deployed ones and any management application that comes pre-installed with it? Also, ...
2
votes
1answer
28 views

What is an ITGC Audit?

I don't get the purpose of such an audit especially given the way it is conducted. We have a 3rd party auditor who I won't name, but let's just say they probably audit the majority of the publicly ...
1
vote
0answers
18 views

AWS Firewall Configuration Review [migrated]

We had a situation where an incorrect AWS firewall rule buried in our configuration was causing some headaches. After a few days we found the rule and fixed it. Does anyone know of a good way to ...
0
votes
0answers
29 views

Strange SECCOMP entries for sshd in audit log

I've posted this over at ServerFault but haven't received a response over there. I'm not a security professional, but I'm curious as to what kind of attack this might be and how the attackers might be ...
1
vote
0answers
19 views

Nessus Windows Compliance Check Issue [closed]

My team and I have been trying to troubleshoot an issue we have had with the Windows compliance check not working for a custom audit. We have enabled firewall and printer connections, tried disabling ...
4
votes
3answers
78 views

How to check that passwords are not stored in a readable format

I'm writing a plan to audit my password policy, and I was stuck on one of my policy controls which was making sure that No password should be stored in a readable format. What is the best practice ...
0
votes
2answers
39 views

Precauations for web application security audit

We have planned to give our web application to a third party vendor,what were the precautionary measures which we need to take care before giving our application to third party vendor? As the vendor ...
0
votes
2answers
69 views

NIDS/NIPS vs HIDS/HIPS

Can we interchangeably deploy a HIDS or HIPS instead of a NIDS/NIPS, what would be the risks, for example you have Symanetec EPS modules with HIPS policies enabled how are they different from a ...
-4
votes
1answer
57 views

How do you deal with personal security issues? [closed]

How do you deal with personal security issues? Let's say you've got reason to assume somebody with big capital may be trying to track your moves. Early in the morning, day after confrontation, you ...
0
votes
1answer
21 views

Advice needed regarding “Information Security Policy” - EI3PA requirements

Our new startup is required to jump through hoops in order to get authorization to use Experian. We are working out of WeWork (shared space). No experian data is stored on our local machines. We do ...
2
votes
2answers
120 views

Will the following PHP code result in source code info leak/disclosure?

I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php. So I went ahead to guard ...
2
votes
0answers
28 views

Finding Audit Reports and Results for Whole Disk Encryption Solutions

Due to TrueCrypt being pulled from the web even though it's been audited, I was asked to compare the audit of TrueCrypt against audits and information available for other products that do whole disk ...
2
votes
0answers
85 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
1
vote
1answer
46 views

Internal access to security sensitive data in a company

I'm building a software that requires a lot of security for the data. The user data in essence is very sensitive. So we are building a lot of encryption, 2 step authentication, app call tokenization ...
0
votes
1answer
61 views

Risk of temporarily unencrypted data during transmission between systems

I have encountered a situation where sensitive data files are saved unencrypted to server file directories temporarily for 1 to 30 minutes before being sent to a destination application. The data ...
0
votes
3answers
80 views

Exploiting a desktop application

I'm studying application security and now I have a question which I couldn't find a good answer. Assume I have a vulnerable desktop application in my virus-free windows 7 PC. Let's say when the file ...
0
votes
0answers
10 views

Categories for Information Security Learning [duplicate]

I'm learning Information Security, Actually I'm a software developer but for my work I need to learn a lot of Information Security, you know attacks and defenses, But I really don't know where to ...
1
vote
1answer
58 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
0
votes
1answer
50 views

Can a security control be both management, technical and operational?

I know that security controls are divided into three categories, namely technical, management and operational. Going through them I always felt as a though a control belonging to one of the above ...
1
vote
0answers
72 views

Vetting new IT development staff [closed]

In the realm of software development what would be the best way to vet prospective employees? We handle potentially sensitive information, and a code base which could be potentially lucrative to ...
1
vote
1answer
99 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
6
votes
2answers
1k views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
0
votes
1answer
121 views

I just found many facebook entries on my registry? [closed]

I don't have a Facebook account but I was messing with my registry deleting old stuff and I found a bunch of Facebook keys and folders. Facebook is notorious for being a tool for spy agencies and has ...
1
vote
1answer
31 views

What is the relation between ANSI and ISO regarding ISO 27000?

So in one answer I was told that ANSI is a governing body (the only one in the world) for ISO 27000? I think I got something wrong, because I don't see ANSI mentioned anywhere when I read about ...
0
votes
2answers
136 views

What could be the scope of ISO 27000 standards?

If a company wants to certify against some of ISO 27000-series standards (let's say ISO 27001 and ISO 27005), what could possibly be certified? I mean, is it IT processes in general in the ...
1
vote
0answers
119 views

How secure is Jitsi VoIP/IM Android app? [closed]

I was looking for a FOSS end-to-end encrypted alternatives to Skype and came over Jitsi. It looks all nice and seems to work really well (at least clients on Linux and Android). Even cross-messaging ...
1
vote
2answers
47 views

Determining a version of SSH from penetration testing?

I am a software developer -- but not a security specialist. A (legitimate) company that does security scans sent my company a notice that we are running an older version of SSH on our hosting server. ...
2
votes
1answer
98 views

Is it common for all hard / USB drives to be accessible to everyone on a network?

Every PC can map to any other PC's hard drive(s) / USB drive(s) on the network where I work. When I realized this I thought it was odd. All one needs to do is access the (Start) button then type ...
0
votes
0answers
40 views

Questions to confirm a good standpoint on web app security?

What should be the questions asked to assess a company on web app security? Our company is in process of partnering with another company in order to outsource web app security work to them. For us ...
0
votes
0answers
44 views

Translating BUILTIN\Users Privileges and Security Settings

I would like to rid my CustomUsers security group from it's dependency on the BUILTIN\Users security group. My goal is to achieve the following: Tightened security (the OS is also hardened) Easy ...
1
vote
2answers
80 views

Using DNS to track browser activity on a LAN

I am trying to create a small network auditing script that tracks HTTP and HTTPS domain names visited by certain hosts using the libpcap wrapper for Nodejs. At its best the script would be able to ...
1
vote
2answers
276 views

Is SpiderOak truly “zero-knowledge”?

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to ...
3
votes
0answers
56 views

Open source tools to run generic audit of user entitlements? [closed]

Over the past years, my team has been asked to conduct audits/reviews for other teams. Most of these audits have been compliance-driven and almost all of them have followed the same format: some group ...
0
votes
0answers
31 views

Security audit framework of Internet Explorer Outlook Web Access (OWA) add-on?

I'm working with a software company that has developed an add-on to Outlook Web Access. They are aggregating data and providing a consolidated view of a particular topic / category. I have experience ...
4
votes
1answer
188 views

CentOS Security Tracker

Most Linux distros provide a page where you can check whether the latest package has any security vulnerabilities and what version they are fixed in. I understand that CentOS derives most of it's ...
0
votes
3answers
102 views

How to integrate AAA and otp

We have AAA services enabled in our organization (about 1000 clients). We want also to add otp (one time password) service. What are the main security concerns about integrating them. Is there any ...
1
vote
1answer
46 views

How do you determine if an open source script contains malicious code?

I am trying to analyze an open source auditing tool to determine if it makes unnecessary and potentially harmful changes to the system. I am interested in determining if the script calls any binaries ...
2
votes
0answers
234 views

Using “Security Compliance Manager” to audit a Windows system

I found a few posts which suggest using Microsoft SCM (Security Compliance Manager) to audit the security of Microsoft software solutions: Windows security policy analysis tool How do I apply a ...
2
votes
1answer
151 views

What question(s) can someone ask an individual to quickly determine their 'hacking ability'?

Scenario: You are on Craigslist searching for cheap electronics and come across an add for cheap E-reader. It's a bit of a deal with about 20-40% off the retail price so you contact the seller and all ...
0
votes
1answer
45 views

Workflow for changes to source code

How do you make sure that in your environment, you have proper controls of your source code. For example, before deployment of any application, there must be approval from the boss and other parties. ...
2
votes
0answers
29 views

How do I start securing a virtual appliance to avoid manipulation? [closed]

We have created an amateur software product related with monitoring and management of specific services. It has been made in Python and runs a web service as frontend to show the data in a nice way ...
3
votes
1answer
134 views

What documentation can I ask a vendor for to show HIPAA compliance

Over the past year, several vendors I've contracted with have claimed hipaa compliance. I have asked them for documentation of their compliance and I've never seen any. I would expect an audit ...
-1
votes
1answer
112 views

how to gain root access to linux machine? [closed]

I am a security auditor and I have faced the following situation: A development company that has a group of Linux machines gives limited access to their users. They asked me to find out all the ...
1
vote
0answers
17 views

Get information about the audit state of software (for OSS)?

How does one go about to determine how well audited/checked a software is? To make this a much more specific question I am interested in ways to ascertain (mailing lists, rankings etc.) that a ...
1
vote
1answer
102 views

what is an internal iso 27001 technical auditor? [closed]

i have been recently hired by an ISO 27001 certified company as an " internal ISO technical auditor". My employer told me that my job is described as follow: this job is created because of the need ...
23
votes
7answers
5k views

What stops a developer from accessing credit card details and other secret data from a company

First of all, I'm sorry if this has been discussed many times. I read many posts about PCI compliance but there are some small things I'm not quite sure about. Suppose there is Mr. GoodGuy, an ...