Evaluation of a person, organization, system, process, enterprise, project or product.

learn more… | top users | synonyms (1)

2
votes
0answers
24 views

How do I start securing a virtual appliance to avoid manipulation? [closed]

We have created an amateur software product related with monitoring and management of specific services. It has been made in Python and runs a web service as frontend to show the data in a nice way ...
2
votes
0answers
36 views

What documentation can I ask a vendor for to show HIPAA compliance

Over the past year, several vendors I've contracted with have claimed hipaa compliance. I have asked them for documentation of their compliance and I've never seen any. I would expect an audit ...
-1
votes
1answer
73 views

how to gain root access to linux machine? [closed]

I am a security auditor and I have faced the following situation: A development company that has a group of Linux machines gives limited access to their users. They asked me to find out all the ...
-1
votes
0answers
19 views

The meaning of apparmor logs [closed]

What is the meaning of the fields in apparmor logs? Is there any document about it? Eg: apparmor="ALLOWED" operation="open" parent=32142 profile="/bin/su//null-1e" name="/proc/32143/attr/current" ...
0
votes
0answers
9 views

Get information about the audit state of software (for OSS)?

How does one go about to determine how well audited/checked a software is? To make this a much more specific question I am interested in ways to ascertain (mailing lists, rankings etc.) that a ...
1
vote
1answer
60 views

what is an internal iso 27001 technical auditor? [closed]

i have been recently hired by an ISO 27001 certified company as an " internal ISO technical auditor". My employer told me that my job is described as follow: this job is created because of the need ...
23
votes
7answers
5k views

What stops a developer from accessing credit card details and other secret data from a company

First of all, I'm sorry if this has been discussed many times. I read many posts about PCI compliance but there are some small things I'm not quite sure about. Suppose there is Mr. GoodGuy, an ...
0
votes
1answer
79 views

SSID rotation prevent tracking or not?

The Program VirtualWifi Manager can rotate SSID's. Does rotating SSID's prevent the google tracking _nomap problem?
24
votes
6answers
2k views

How can security audits be integrated into an agile project?

If we give a security auditing company a working system, and ask them to audit it, and only do that once during a project because it's expensive, this is basically waterfall. How can security ...
0
votes
2answers
190 views

“Shell shock” - exploitable when `system()` syscall or `exec(bash)`, right?

Is my understanding correct that in order to exploit via "Shell Shock", binary we influence needs to execute bash (and we need to have influence on command line)? Therefore, am I correct, that if ...
3
votes
2answers
68 views

Any advice on how to assure patients that a medical facility is well protected against identity theft?

My apologies if this question has been asked before. How does a medical practice assure patients that the practice follows excellent computer security practices? Conversely, how does a patient find ...
2
votes
2answers
125 views

How can one secure Exchange 2010 cookies?

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an ...
0
votes
2answers
220 views

Is this hash function safe?

Below is the hash function implementation of the roguewave library. It returns a 32 bit hash. The core operation is A = B ^ ((C << 5) | (C >> 27)). Is this hash safe to use as a password check ...
1
vote
2answers
69 views

Information Security and Financial Risks

Recently, we've been asked by Audit Dpt. to have financial risks controls in our ERP (fraud-like incidents). Our question is if this request is covered by the scope of Information Security Dept? If ...
2
votes
2answers
112 views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
3
votes
3answers
662 views

Websites Forcing Weak Password Standards (Updated) [duplicate]

Please Note: I am not going to name the websites which have these horrible standards for their clients and users. I have had to change my passwords for my routine update just recently in the last ...
1
vote
3answers
152 views

In a company is it good to have a back door account?

Having a backdoor account (that is a username/password that can login in to an administrative account on all machines) can be very useful for IT staff. However, some believe it's a security breach. ...
2
votes
1answer
85 views

Auditing Event Logs of a System

Soon I will be acquiring the event logs of the systems my company produces and expected to audit them. Multiple logs are generated from each computer and there are multiple operating systems to audit. ...
3
votes
3answers
123 views

Trusting SSL and the Trust Chain

As we all know, when an SSL Certificate is assigned, there is a trust chain that is created for verify everyone from the Certificate Authority to the actual website's SSL Certificate. Thanks to a ...
3
votes
4answers
179 views

Storing Old Password History and Information

Google, Facebook, Twitter, and several other services still knows the older passwords which we used on our accounts. At times, I can not reuse the same password as I have. Then with Google, if I type ...
3
votes
1answer
71 views

Issues with format of Logs generated by Auditd

I have below snapshot of log generated by auditd when I tried to delete a user. It doesn't have hostname and addr in the logs: type=DEL_USER msg=audit(1404811391.243:4407153): user pid=5772 uid=0 ...
1
vote
0answers
70 views

What tools on unix can scan sql dumps for malware? [closed]

I'm attempting to check for malware, spam and any kind of injection/exploitation on a sql dump that has been provided and was wondering what kind of tools are there already in place to help with this? ...
3
votes
2answers
486 views

How can I get a fiddler-style trace of an iPhone / Android?

I want to audit the HTTP and HTTPS activity of apps downloaded onto my mobile device. What is the best way to do this? I own the device, can add a root certificate, and can connect the running ...
-1
votes
2answers
79 views

Tools to test all-around hardness of a Unix installation? [closed]

I'm looking for tools that will audit a very simple Unix (Linux or BSD) installation, identify vulnerabilities, and perhaps give suggestions for fixing them. I realize that "penetration testing" can ...
1
vote
1answer
221 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
2
votes
1answer
220 views

How to work effectively to win bug-bounties?

I really want to prove myself (to my parents) by winning a proper bug bounty How should I best prepare for this and go about actually finding bugs? Edit So can anyone give some web sites ...
-1
votes
0answers
130 views

An Efficient and Secure Dynamic Auditing Protocol for Data Storage in Cloud Computing [closed]

I am doing research on this topic and have to submit research paper in my college. I've googled many times for relevant material but didn't find anything suitable. Here are some key features : ...
1
vote
1answer
137 views

Where can I find a list of checksums for windows files? Why don't MS sign all their executables?

Is there anywhere I can download a list of checksums for microsoft-published OS executable files, preferably grouped by release name? I could do the same by decompressing files on a windows setup CD, ...
3
votes
2answers
157 views

Search on encrypted data of multiple users

I want to implement a search over encrypted data. I found a blogpost, which explains 3 methods. One method is to use deterministic encryption, which I'm trying to implement. But my use case is a ...
4
votes
1answer
169 views

Is it a security risk for users not to logout of a website?

Is it a security risk to myself that I am not logging out of Twitter, Facebook, StackExchange, and a majority of the sites which I am using? Is there a chance for someone to hijack my session or cause ...
0
votes
2answers
45 views

Dynamic analysis tools in windows

I'm sorry, i'm newbie in security, i'm looking for a software that detect changes in the whole operating system during its execution, that's helps analysing the behaviour of malicious software to know ...
3
votes
1answer
211 views

Can we trust encrpytion when the random number generator is compromised?

How can we trust our encryption methods if our random number generators are to be [assumed] compromised? Does encryption also depend on the random number generators of our hardware? I forgot to also ...
-2
votes
3answers
163 views

How do I communicate security issues encountered on an online banking platform?

Occasionally, I've produced (and reproduced) the HTTP 500 Internal Server Error on an online banking platform - quite a famous one. I suppose the errors are due to bugs in back end code, possibly ...
34
votes
6answers
4k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole ? ...
3
votes
1answer
104 views

BYOD - Looking for Secure means of Wiping Data Remotely

We are in the process of implementing a Bring Your Own Device policy to allow our many employees to use their personal laptops and desktops (Windows platform) to VPN into our company's network. These ...
1
vote
1answer
197 views

Multi Tenant Database - HIPAA

We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) ...
3
votes
2answers
155 views

Password capturing from dump file or browser after log out

I am working on web application security auditing. I was going through various checklists & methodology. I found one interesting stuff in a document. Type - Configuration Management Security ...
4
votes
3answers
2k views

Bittorrent Sync encryption

Sync, a new product from BitTorrent, Inc., has been cited as a viable alternative to other cloud-storage platforms. The Sync FAQ indicates that an encryption scheme is being used, but does not comment ...
4
votes
1answer
153 views

Installing profile on “Good” Mail application give someone admin permission on my iPhone

My new enterprise use the app "GOOD" for the emails. But to use it, I have to install a GOOD profile with description : "Install this profile to enroll to encrypted profile service". If I choose ...
2
votes
1answer
275 views

RKHunter and CHKRootkit Warns About /usr/lib/pymodules/python2.7/.path

In relation to my previous question. I have this Warning again from both RKHunter and Chkrootkit. My VPS has been turned off for how many weeks, until I turned it on again to deploy my website. After ...
1
vote
0answers
27 views

Why is Windows auditing svchost by default?

I would like to know why, by default, Windows set an audit rules on svchost.exe ? While it's used only when auditing is active, i don't understand why there's a special treatment for this file since ...
2
votes
1answer
1k views

How to crack SHA512 hexdigest passwords with John the Ripper?

I've been playing with John The Ripper (JtR) to try to crack/audit a salted password that was hashed with SHA-512, with 20 interactions according to the source (for the curious, this is a Rails app, ...
0
votes
1answer
39 views

programs or methods to review Internet browser applications for security [closed]

I've been tasked with doing a security review on a Firefox update, but we don't have any utilities that we can find. How would we go about running a security review on Firefox before pushing it to ...
2
votes
1answer
202 views

How can I prove to a third party that I'm sending the emails I'm supposed to?

Suppose one of my duties for a small organization is to send out statements to clients by email. Suppose one of the directors / owners / trustees want to be able to audit the numbers. Specifically he ...
1
vote
0answers
46 views

Secure 'pg_settings' for PostgreSQL

I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB. I came across this url, have checked the same. Anything more to this?: ...
0
votes
6answers
561 views

Does ISP have control on all routers in their network?

When I was changing my router my ISP technician told me that he has remote access to all routers provided by ISP. Was that true? If that is a fact it scares me...
2
votes
1answer
282 views

Extracting the GPG userid from the Public key file?

Is it possible to extract userid from GPG public key? I got public key only and want to know to whom it might belong. I find one possible workaround — to publish this information on keyserver — it ...
1
vote
1answer
85 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
0
votes
3answers
199 views

How to safely mirror network traffic for audit reasons?

We have an internet connection that we need to audit: INTERNET ->> ROUTER ->> CLIENTS our idea would be to put a (enough big) HUB before the router (router, that logs in via pppoe to ...
3
votes
1answer
543 views

SCADA, ICS Specfic Testing Tools and Methodologies

I have been contracted to perform a security risk assessment that relates specifically to ICS and SCADA systems. I have performed many IT security risk assessments, however, I am new to assessing ...