Evaluation of a person, organization, system, process, enterprise, project or product.

learn more… | top users | synonyms (1)

0
votes
0answers
20 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
-2
votes
0answers
31 views

Tool to Search a Network for Strings in Files [closed]

I'm hoping this can belong here. Do you know of a good tool that can be used to search strings in files across a Network? We have about 200 PCs in our environment. We also have Nessus but I ...
0
votes
2answers
67 views

How unsecure would I assume old PHP code is? [closed]

We have several websites that are client facing at a very large company. These websites do gather client information. They were written 6-7 years ago, quite possibly using a PHP/mysql code ...
-2
votes
1answer
30 views

Router connected to my ethernet [duplicate]

I'm guessing that someone is bringing his router to provide wifi to his coworkers, by connecting it to a certain point on one of the 8 floors of my building, how can I know where is connected?
1
vote
1answer
52 views

How to check third party code for Security? [closed]

This may be a very broad question. I am a software developer and from time to time we use third party components which may / may not be secure. Are there any basic things that I should check the ...
0
votes
1answer
75 views

Surveillance in the Workplace? [closed]

Auditing, surveillance and logging are typical and common place in the workplace, understandably so. These actions are crucial to establishing metrics and performance of the network and its resources. ...
2
votes
1answer
43 views

How to audit login on a Debian distribution if var/log was deleted

Last week I had a linux debian distribution accessible from Internet compromised through SSH for 24 hours. As far as I know the attacker could get root privileges and performed some malicious actions. ...
4
votes
1answer
72 views

Did KeePassX ever have an audit funding?

Did KeePassX ever had an Audit Funding like ex.: TrueCrypt? Or any other password manager?
-3
votes
1answer
43 views

Little bit confusing with nmap scan

I started MySQL with this command service mysql start and it worked pretty well. So: Using the netstat command, I found 127.0.0.1:3306 was in listening state, this is the MySQL service. So I did a ...
0
votes
1answer
42 views

Basis for “trusting” third party code and services

I remember reading an article mentioning, that third party services and code should not be trusted, meaning blind trust. So, i was thinking, everyone uses third party code in software development ...
3
votes
0answers
48 views

How to group user actions within the same session?

I'm working on enterprise application where it's needed to audit all user actions (data modification, settings changing etc.) within their work session. What is the best way to group all that actions ...
1
vote
0answers
39 views

What kinds of features are useful for network security visualization? [closed]

I just want to know is network security visualization are practical for enterprise network administrators? (Which I am not) And if it is what kind of tools they uses and what kind of features they are ...
1
vote
1answer
43 views

Security evaluation terminology

I'm learning about Protection Profiles, Security Targets and Target of Evaluations, and these all seem like very abstract ideas to me. Could someone explain with examples how these work in practice? ...
7
votes
3answers
93 views

Is it possible to determine if the BIOS has been modified between two points in time?

Is it possible to determine if the BIOS of a computer has been modified between two points in time from that computer while it's running ? Effectively I'd like to be able to gather the equivalent of ...
1
vote
1answer
41 views

Between point to point connectivity and remote network access, which is riskier?

Between point to point connectivity and remote network access, which is riskier? If I have a third party accessing my company's network, which are the different modes through which they can access and ...
1
vote
2answers
118 views

What's the most secure way to save Connection String in Windows Forms application?

I just got myself in a new company where they develop Windows Forms applications using .NET technologies and VB.NET, Of course. They use SQL Server databases. The BIG issue is that they store the ...
-3
votes
2answers
123 views

attack on port 80 [closed]

I have a ubuntu ec2 instance server hosting apache2 site & tomcat7 at back end. According to apache logs I have doubt there malicious attack ! Please can anyone confirm it & what can i do to ...
2
votes
2answers
81 views

PCI audits, TLS 1.0, and scoring

I'm new to security in a variety of ways. We have a PCI audit coming up soon. We've put together a risk mitigation/migration plan for TLS 1.0 and have submitted it to the auditors. My boss is ...
-1
votes
1answer
34 views

Security audits priority [closed]

Security audits could be technical such as penetration testing, configuration review and network architecture review. or non technical such as Organisational audits (based on iso 2700X, physical ...
1
vote
0answers
16 views

Zenmap question on scanning [closed]

Using Zenmap, I continue to get host down notifications when completing a scan on all ip addresses scanned, what am I doing wrong? I am new to infosec and loving it so far..
5
votes
1answer
67 views

Should I have special emoticon handling for compliance, audit and logging?

I'm required to audit various communications (email, sms, messenger, social media) for keywords relating to financial data, HIPPA, and other PII. Is there any rational reason I should extend my ...
4
votes
1answer
179 views

Is there an equivalent of nsp audit for nuget packages?

I'm working on a couple of large .NET web apps and would like to audit the packages used in them. For node projects I've use nsp audit. This checks whether your npm packages or their dependencies have ...
4
votes
2answers
91 views

In CIA triad of information security, what's the difference between confidentiality and availability?

I sometimes get confused between confidentiality and availability. This site defines confidentiality as Measures undertaken to ensure confidentiality are designed to prevent sensitive ...
-1
votes
2answers
178 views

Things to look for a backdoor in web application source code (.PHP, .JS, etc files) [closed]

I am in the process of adding functionality to a web application and I will be receiving some source files (PHP, JS, and CSS) from a hired external developer. These files are not obfuscated or ...
2
votes
1answer
73 views

Can we determine how securely files are stored on a cloud storage service?

After asking two questions about the security of online cloud storage, it seems to me that we can only at best speculate as to the security practices of the hosting company, and believe what they tell ...
5
votes
1answer
291 views

How do I stop my IP from being resolved through my Skype?

I recently discovered that someone found out my current IP info via Skype among other information. People can do this via a thing called Skype resolvers. However nothing I do so far seems to work. I ...
7
votes
2answers
161 views

Breaching a computer knowing only IP when all ports closed - possible?

I'm checking my setup for security holes with some dedicated Linux distros. First thing I did was to scan all ports, and beyond that - it seems like it's pretty much unhackable. Since all ports were ...
3
votes
1answer
67 views

How to verify .plist and .kext files are legitimate?

While scouring through tons of logs generated during an audit of a Mac filesystem after a potential malware infection, and I am wondering if there are any better ways to verify that all kernel ...
-1
votes
1answer
118 views

Configuration audit for IPS/IDS [closed]

I have been given the task of configuration audit as my first task in my first job. As a challenge I have to find vulnerabilities by reading the logs of the PuTTy session and I do not have access to ...
0
votes
2answers
119 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
0
votes
1answer
90 views

Is it safe to check if device is subject to Stagefright bug? [closed]

Is it safe to check if device is subject to Stagefright bug, for example with: Stagefright Detector App forAndroid by Zimperium ? Is such (or similar test) sufficient? Is there available any 3rd ...
4
votes
1answer
111 views

Protect password/authenticating during transit over (insecure) TCP socket for a game

Background I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join. The server has a ...
4
votes
2answers
131 views

How can I verifiably demonstrate that steganography or hidden partitions do not exist?

I want to verifiably demonstrate that there are no hidden partitions, or hidden messages in a given message. In this scenario, assume the subject is being monitored (consensually) and agrees to align ...
0
votes
1answer
146 views

How secure are the passwords stored at Google Passwords? [closed]

It seems Google activated central place for storing app/website passwords which is accessible at https://passwords.google.com/ and all the remembered Chrome passwords are synched there. In what ...
-3
votes
3answers
184 views

Does MEGA cloud service say ALL the truth? [closed]

If this is not the right community for this question please inform me where to ask :-) I am talking about: encryption no enceyption key kept by MEGA and so on. I found many reviews confirming ...
1
vote
2answers
255 views

Will hacking (pentesting) a live website from a VM improve or hinder my hacker anonymity?

Would a pentest initiated from a VM mounted on hard drive be more or less anonymous to IDS attack or forensically traceable? Please note: I will be browsing via tor and kproxy and have all that ...
1
vote
0answers
145 views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
1
vote
1answer
30 views

Security Assessment v/s Security Engagement Breakdown [closed]

I had this couple of threads in here which talks about security assessment v/s risk assessments, but here the idea is completely different. Suppose, I had to breakdown qualitative tasks from the ...
1
vote
1answer
112 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
0
votes
2answers
115 views

Performing a vulnerability assessment on Windows Tablets?

How does a security auditor perform a vulnerability assessment for Windows Tablets including Surface RT tablets deployed ones and any management application that comes pre-installed with it? Also, ...
2
votes
1answer
392 views

What is an ITGC Audit?

I don't get the purpose of such an audit especially given the way it is conducted. We have a 3rd party auditor who I won't name, but let's just say they probably audit the majority of the publicly ...
1
vote
1answer
96 views

Strange SECCOMP entries for sshd in audit log

I've posted this over at ServerFault but haven't received a response over there. I'm not a security professional, but I'm curious as to what kind of attack this might be and how the attackers might be ...
1
vote
0answers
77 views

Nessus Windows Compliance Check Issue [closed]

My team and I have been trying to troubleshoot an issue we have had with the Windows compliance check not working for a custom audit. We have enabled firewall and printer connections, tried disabling ...
5
votes
3answers
96 views

How to check that passwords are not stored in a readable format

I'm writing a plan to audit my password policy, and I was stuck on one of my policy controls which was making sure that No password should be stored in a readable format. What is the best practice ...
1
vote
2answers
209 views

Precauations for web application security audit

We have planned to give our web application to a third party vendor,what were the precautionary measures which we need to take care before giving our application to third party vendor? As the vendor ...
0
votes
2answers
1k views

NIDS/NIPS vs HIDS/HIPS

Can we interchangeably deploy a HIDS or HIPS instead of a NIDS/NIPS, what would be the risks, for example you have Symanetec EPS modules with HIPS policies enabled how are they different from a ...
-4
votes
1answer
101 views

How do you deal with personal security issues? [closed]

How do you deal with personal security issues? Let's say you've got reason to assume somebody with big capital may be trying to track your moves. Early in the morning, day after confrontation, you ...
1
vote
1answer
43 views

Advice needed regarding “Information Security Policy” - EI3PA requirements

Our new startup is required to jump through hoops in order to get authorization to use Experian. We are working out of WeWork (shared space). No experian data is stored on our local machines. We do ...
2
votes
2answers
426 views

Will the following PHP code result in source code info leak/disclosure?

I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php. So I went ahead to guard ...
2
votes
0answers
56 views

Finding Audit Reports and Results for Whole Disk Encryption Solutions

Due to TrueCrypt being pulled from the web even though it's been audited, I was asked to compare the audit of TrueCrypt against audits and information available for other products that do whole disk ...