Evaluation of a person, organization, system, process, enterprise, project or product.

learn more… | top users | synonyms (1)

-1
votes
1answer
62 views

how to gain root access to linux machine? [on hold]

I am a security auditor and I have faced the following situation: A development company that has a group of Linux machines gives limited access to their users. They asked me to find out all the ...
0
votes
0answers
16 views

The meaning of apparmor logs

What is the meaning of the fields in apparmor logs? Is there any document about it? Eg: apparmor="ALLOWED" operation="open" parent=32142 profile="/bin/su//null-1e" name="/proc/32143/attr/current" ...
-1
votes
0answers
50 views

Are ISO 27001 & pentesting compatible?

I have been recently hired by an ISO 27001 certified company as an ISO team member who will take charge of the technical audits (access control, backup & recovery, ...). My other major ...
0
votes
0answers
9 views

Get information about the audit state of software (for OSS)?

How does one go about to determine how well audited/checked a software is? To make this a much more specific question I am interested in ways to ascertain (mailing lists, rankings etc.) that a ...
1
vote
1answer
58 views

what is an internal iso 27001 technical auditor? [closed]

i have been recently hired by an ISO 27001 certified company as an " internal ISO technical auditor". My employer told me that my job is described as follow: this job is created because of the need ...
23
votes
7answers
5k views

What stops a developer from accessing credit card details and other secret data from a company

First of all, I'm sorry if this has been discussed many times. I read many posts about PCI compliance but there are some small things I'm not quite sure about. Suppose there is Mr. GoodGuy, an ...
0
votes
1answer
76 views

SSID rotation prevent tracking or not?

The Program VirtualWifi Manager can rotate SSID's. Does rotating SSID's prevent the google tracking _nomap problem?
23
votes
6answers
2k views

How can security audits be integrated into an agile project?

If we give a security auditing company a working system, and ask them to audit it, and only do that once during a project because it's expensive, this is basically waterfall. How can security ...
0
votes
2answers
170 views

“Shell shock” - exploitable when `system()` syscall or `exec(bash)`, right?

Is my understanding correct that in order to exploit via "Shell Shock", binary we influence needs to execute bash (and we need to have influence on command line)? Therefore, am I correct, that if ...
3
votes
2answers
66 views

Any advice on how to assure patients that a medical facility is well protected against identity theft?

My apologies if this question has been asked before. How does a medical practice assure patients that the practice follows excellent computer security practices? Conversely, how does a patient find ...
2
votes
2answers
88 views

How can one secure Exchange 2010 cookies?

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an ...
0
votes
2answers
217 views

Is this hash function safe?

Below is the hash function implementation of the roguewave library. It returns a 32 bit hash. The core operation is A = B ^ ((C << 5) | (C >> 27)). Is this hash safe to use as a password check ...
1
vote
2answers
67 views

Information Security and Financial Risks

Recently, we've been asked by Audit Dpt. to have financial risks controls in our ERP (fraud-like incidents). Our question is if this request is covered by the scope of Information Security Dept? If ...
2
votes
2answers
105 views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
3
votes
3answers
652 views

Websites Forcing Weak Password Standards (Updated) [duplicate]

Please Note: I am not going to name the websites which have these horrible standards for their clients and users. I have had to change my passwords for my routine update just recently in the last ...
1
vote
3answers
150 views

In a company is it good to have a back door account?

Having a backdoor account (that is a username/password that can login in to an administrative account on all machines) can be very useful for IT staff. However, some believe it's a security breach. ...
2
votes
1answer
80 views

Auditing Event Logs of a System

Soon I will be acquiring the event logs of the systems my company produces and expected to audit them. Multiple logs are generated from each computer and there are multiple operating systems to audit. ...
3
votes
3answers
115 views

Trusting SSL and the Trust Chain

As we all know, when an SSL Certificate is assigned, there is a trust chain that is created for verify everyone from the Certificate Authority to the actual website's SSL Certificate. Thanks to a ...
3
votes
4answers
174 views

Storing Old Password History and Information

Google, Facebook, Twitter, and several other services still knows the older passwords which we used on our accounts. At times, I can not reuse the same password as I have. Then with Google, if I type ...
3
votes
1answer
63 views

Issues with format of Logs generated by Auditd

I have below snapshot of log generated by auditd when I tried to delete a user. It doesn't have hostname and addr in the logs: type=DEL_USER msg=audit(1404811391.243:4407153): user pid=5772 uid=0 ...
1
vote
0answers
68 views

What tools on unix can scan sql dumps for malware? [closed]

I'm attempting to check for malware, spam and any kind of injection/exploitation on a sql dump that has been provided and was wondering what kind of tools are there already in place to help with this? ...
3
votes
2answers
390 views

How can I get a fiddler-style trace of an iPhone / Android?

I want to audit the HTTP and HTTPS activity of apps downloaded onto my mobile device. What is the best way to do this? I own the device, can add a root certificate, and can connect the running ...
-1
votes
2answers
78 views

Tools to test all-around hardness of a Unix installation? [closed]

I'm looking for tools that will audit a very simple Unix (Linux or BSD) installation, identify vulnerabilities, and perhaps give suggestions for fixing them. I realize that "penetration testing" can ...
1
vote
1answer
185 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
2
votes
1answer
213 views

How to work effectively to win bug-bounties?

I really want to prove myself (to my parents) by winning a proper bug bounty How should I best prepare for this and go about actually finding bugs? Edit So can anyone give some web sites ...
-1
votes
0answers
123 views

An Efficient and Secure Dynamic Auditing Protocol for Data Storage in Cloud Computing

I am doing research on this topic and have to submit research paper in my college. I've googled many times for relevant material but didn't find anything suitable. Here are some key features : ...
1
vote
1answer
134 views

Where can I find a list of checksums for windows files? Why don't MS sign all their executables?

Is there anywhere I can download a list of checksums for microsoft-published OS executable files, preferably grouped by release name? I could do the same by decompressing files on a windows setup CD, ...
3
votes
2answers
153 views

Search on encrypted data of multiple users

I want to implement a search over encrypted data. I found a blogpost, which explains 3 methods. One method is to use deterministic encryption, which I'm trying to implement. But my use case is a ...
4
votes
1answer
163 views

Is it a security risk for users not to logout of a website?

Is it a security risk to myself that I am not logging out of Twitter, Facebook, StackExchange, and a majority of the sites which I am using? Is there a chance for someone to hijack my session or cause ...
0
votes
2answers
44 views

Dynamic analysis tools in windows

I'm sorry, i'm newbie in security, i'm looking for a software that detect changes in the whole operating system during its execution, that's helps analysing the behaviour of malicious software to know ...
3
votes
1answer
209 views

Can we trust encrpytion when the random number generator is compromised?

How can we trust our encryption methods if our random number generators are to be [assumed] compromised? Does encryption also depend on the random number generators of our hardware? I forgot to also ...
-2
votes
3answers
158 views

How do I communicate security issues encountered on an online banking platform?

Occasionally, I've produced (and reproduced) the HTTP 500 Internal Server Error on an online banking platform - quite a famous one. I suppose the errors are due to bugs in back end code, possibly ...
34
votes
6answers
4k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole ? ...
3
votes
1answer
102 views

BYOD - Looking for Secure means of Wiping Data Remotely

We are in the process of implementing a Bring Your Own Device policy to allow our many employees to use their personal laptops and desktops (Windows platform) to VPN into our company's network. These ...
1
vote
1answer
186 views

Multi Tenant Database - HIPAA

We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) ...
3
votes
2answers
139 views

Password capturing from dump file or browser after log out

I am working on web application security auditing. I was going through various checklists & methodology. I found one interesting stuff in a document. Type - Configuration Management Security ...
4
votes
3answers
2k views

Bittorrent Sync encryption

Sync, a new product from BitTorrent, Inc., has been cited as a viable alternative to other cloud-storage platforms. The Sync FAQ indicates that an encryption scheme is being used, but does not comment ...
4
votes
1answer
140 views

Installing profile on “Good” Mail application give someone admin permission on my iPhone

My new enterprise use the app "GOOD" for the emails. But to use it, I have to install a GOOD profile with description : "Install this profile to enroll to encrypted profile service". If I choose ...
2
votes
1answer
266 views

RKHunter and CHKRootkit Warns About /usr/lib/pymodules/python2.7/.path

In relation to my previous question. I have this Warning again from both RKHunter and Chkrootkit. My VPS has been turned off for how many weeks, until I turned it on again to deploy my website. After ...
1
vote
0answers
27 views

Why is Windows auditing svchost by default?

I would like to know why, by default, Windows set an audit rules on svchost.exe ? While it's used only when auditing is active, i don't understand why there's a special treatment for this file since ...
2
votes
1answer
1k views

How to crack SHA512 hexdigest passwords with John the Ripper?

I've been playing with John The Ripper (JtR) to try to crack/audit a salted password that was hashed with SHA-512, with 20 interactions according to the source (for the curious, this is a Rails app, ...
0
votes
1answer
39 views

programs or methods to review Internet browser applications for security [closed]

I've been tasked with doing a security review on a Firefox update, but we don't have any utilities that we can find. How would we go about running a security review on Firefox before pushing it to ...
2
votes
1answer
194 views

How can I prove to a third party that I'm sending the emails I'm supposed to?

Suppose one of my duties for a small organization is to send out statements to clients by email. Suppose one of the directors / owners / trustees want to be able to audit the numbers. Specifically he ...
1
vote
0answers
44 views

Secure 'pg_settings' for PostgreSQL

I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB. I came across this url, have checked the same. Anything more to this?: ...
0
votes
6answers
508 views

Does ISP have control on all routers in their network?

When I was changing my router my ISP technician told me that he has remote access to all routers provided by ISP. Was that true? If that is a fact it scares me...
2
votes
1answer
255 views

Extracting the GPG userid from the Public key file?

Is it possible to extract userid from GPG public key? I got public key only and want to know to whom it might belong. I find one possible workaround — to publish this information on keyserver — it ...
1
vote
1answer
85 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
0
votes
3answers
194 views

How to safely mirror network traffic for audit reasons?

We have an internet connection that we need to audit: INTERNET ->> ROUTER ->> CLIENTS our idea would be to put a (enough big) HUB before the router (router, that logs in via pppoe to ...
3
votes
1answer
525 views

SCADA, ICS Specfic Testing Tools and Methodologies

I have been contracted to perform a security risk assessment that relates specifically to ICS and SCADA systems. I have performed many IT security risk assessments, however, I am new to assessing ...
2
votes
2answers
462 views

Basic Security Knowledge [closed]

Perhaps I am being both naive and overly ambitious in my first post but I have a huge interest in learning about network and system security and am at a loss as to where to begin. I realize that stack ...