Evaluation of a person, organization, system, process, enterprise, project or product.

learn more… | top users | synonyms (1)

4
votes
1answer
160 views

auditing open source compiler binaries for trojans

It is a well known vulnerability that a properly altered compiler binary can transfer itself to new binaries of the compiler, and still be entirely absent from the source code. But how real is this ...
4
votes
3answers
689 views

MS-SQL Monitoring/Auditing of PHI for HIPAA

We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the ...
4
votes
3answers
292 views

Is it necessary to test all input parameters of a web application when testing its security?

We know that testing input parameters for lack of validation is one part of a black box web vulnerability assessment but, is it necessary to test ALL input parameters (parameters, cookies, HTTP ...
10
votes
4answers
390 views

How can I audit which type of Block Mode encryption is being used when no source code is available?

Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
2
votes
1answer
861 views

How can I misuse the information of DCE service enumeration?

Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information: 192.168.1.23 - UUID ...
0
votes
4answers
163 views

Control over IT security

In pharmacy the safety of drugs is under fairly tight control by national authorities, e.g. FDA in US. The risks of patients taking drugs are thus very effectively minimized, though understandably ...
3
votes
1answer
270 views

Auditing, accounting, logging, and accountability… What's the difference?

Let's first look at the book Microsoft Windows Security Essentials: ... the three As (AAA) of security: authentication, authorization, and accounting ... they combine to contribute to reliable ...
3
votes
1answer
146 views

How do you evaluate and audit Central Authentication Service (CAS)?

This is in reference to Jasig's CAS software and I'm looking for a checklist to audit the state of security of a CAS implementation. While the Jasig site has a lot of documentation and their mailing ...
3
votes
2answers
261 views

Security Scanning for Desktop Applications

Our company develops Windows desktop applications. We offer off the shelf solutions - not custom development. A potential new customer wants to add a section to our standard contract that requires ...
3
votes
1answer
127 views

Is there any public information on audited Java open source projects?

I'm sure that there must have been any number of audits on common Java open source projects, many of them for governments or publicly-funded bodies. Have any of the results been made public, so that ...
5
votes
1answer
125 views

Integrity check against package repository?

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
11
votes
3answers
1k views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
2
votes
3answers
328 views

rancid like tool for config files

I need to be able to watch directories on our servers, and track changes to files as part of our audit compliance. I have adjusted auditd to watch the directories, and send all writes and attribute ...
2
votes
1answer
225 views

How much are security tools audited?

Just an open question to the security community at large because... well... the phpMyAdmin thing has made me more paranoid than usual... Specifically, I'm thinking about Kali Linux (ex-BackTrack). ...
1
vote
1answer
77 views

What audit procedures are applied to ENotaries and to the software they use?

From a theoretical standpoint, the very notion of an electronic notary - ENotary implies a host of problems related to biometrics, signature revocation, timestamping, keeping a reliable electronic ...
11
votes
2answers
383 views

What should I look for when auditing a Firefox extension / plugin?

I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert. What kinds of ...
1
vote
0answers
143 views

Which are appropiate tests to perform during an internal/LAN security audit? [closed]

In the internal network we know that controls are less strict than externally but in the other hand we know that lots of attacks come from the internal segment (unhappy workers, etc.) Which are ...
5
votes
4answers
432 views

Source code auditing and fake builds

I am wondering about source code auditing and how hard it would be to fake a build to be audited? Let me explain. Say I would be a dishonest programmer that would wish to put in some backdoor into ...
4
votes
1answer
116 views

Are we obliged to provide a complete log should auditors ask for it?

We have a system that outputs and rotate logs on a daily basis. If an auditor requests us to provide logs of a particular date for a particular task, are we obliged to provide a complete full day ...
2
votes
2answers
300 views

Suspect Exchange Server appears to be hacked. How to determine if it was a false positive?

Our security vendor detected that our client's CAS server was doing a nessus scan in the internal network. It's not uncommon for this vendor to issue a false positive, but I'm looking for general ...
1
vote
1answer
145 views

How does a PCI QSA audit a company?

Corporate setups are often complex with data centers in multiple locations, complex ACL's and networks setup between them. How does a PCI auditor actually audit the systems ? How does he get to know ...
20
votes
7answers
3k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always wrote a short PDF quickly explaining what I encountered and ...
1
vote
1answer
389 views

How to define audit controls responsibility? @ SIEM

I'm assigned to write procedural documentation for the SIEM use cases for the IT asset owners. For example, the procedures for selecting events indicating unauthorized access to user-mail box. I have ...
4
votes
1answer
1k views

What tools can be use for Security Auditing for Redhat

Are there any good tools that can be used for Security auditing of Redhat Linux. That can audit all the critical areas of System and provide the detailed output of all the audited sections.
8
votes
2answers
442 views

How dangerous is it to use third-party security audit tools?

This question is inspired by two related questions (How safe is backtrack to use, and How to Install, Configure and Use LSAT on Unix SE). Besides a dated (and patched) vulnerability in LSAT ...
1
vote
1answer
106 views

Who should I use for auditing/cerifying server software or specific deployment

Background: our company provides an online service. The service is provided both to general public, and to enterprise customers. Enterprise customers are signed on as part of sales efforts. We have ...
4
votes
1answer
171 views

Managing a large amount of MBSA Results?

I am responsible for scanning and fixing issues on ~50 servers with Microsoft Baseline Security Analyzer (MBSA) version 2.2. Unfortunately, there is no out of the box way to manage multiple MBSA ...
1
vote
2answers
145 views

Auditing EXEs to ensure buffer overflow protections are in place? (such as SEHOP, ASLR, and DEP)

According to this answer, it's possible to compile a GCC-based application without certain buffer overflow techniques. Perhaps this is even possible with Visual Studio. How can I audit a given EXE ...
2
votes
3answers
2k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
1
vote
3answers
819 views

using network switches to prevent malicious promiscuous mode usage

I was reading the wiki about promiscuous mode when I came across a piece of information here that suggests that one could use network switches to prevent malicious use of promiscuous mode. In the ...
6
votes
4answers
1k views

Why is penetration testing important

In improving the security of an organization, it seems as though an audit of existing code, procedures, policies, infrastructure, etc. would be absolutely sufficient to reveal any security or policy ...
1
vote
2answers
267 views

Printer Job Auditing

Is there a way to audit the actual contents of print jobs sent to a Windows 2008 / Windows 2012 print server? I'm not interested in the metadata (pages, username, datatime etc), but the job itself ...
2
votes
3answers
162 views

I want to have the security of my crypto code checked, how should I go about doing so?

Specifically part of my system stores encrypted information in a database. I wrote the code that actually does the encrypting/decrypting using an existing cipher. How should I go about making sure ...
3
votes
5answers
235 views

How can I easily determine if a website security company is reputable?

Is there a BBB-type listing or some other reputable badge I should look for when choosing someone to perform a security review?
2
votes
3answers
1k views

Why would you do a password audit

I was thinking last night after reading an article about pen testing and security audits, why would you get a list of all the passwords for the company you are auditing and put them through a piece of ...
0
votes
1answer
117 views

PCI onsite QSA Audit Review

Has anyone had any success using video recordings from ObserveIT during a PCI onsite QSA audit review? We are scheduled to be audited in a few months and are considering adding ObserveIT to ...
1
vote
1answer
106 views

Does the “Special Groups” feature in Vista, 2008, R2, and Windows 7 apply to File System access?

The Windows 2008R2 "Special Groups" feature allows for detailed tracking of domain administrators when they log into the machine. This is accomplished by editing a registry key or the LSA. Is there a ...
0
votes
3answers
464 views

Code auditing and/or fuzzing - Books and resources

I've read the 'Shellcoder's Handbook' as well as 'The Art of Exploitation', and appreciated both a lot. Now I'm looking for additional resources delving into vulnerability spotting, code auditing, and ...
1
vote
2answers
740 views

Firewall audit log management tools

is there any free or open source tools that is able to collect audit logs from firewall in syslog format for monitoring purposes? There is 2 firewall in my organization and I would like to track ...
-2
votes
1answer
934 views

How to retrive domain account hashes from windows 2008 server? [closed]

I want to do password length audit of domain password using offline brute force analysis. I cannot find any domain hashes from local machines , I want an approach where i can retrieve these hashes ...
2
votes
2answers
1k views

NSA RHEL5 Checklist

The NSA has came up with the "Guide to the Secure Conguration of Red Hat Enterprise Linux 5" (http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2.pdf) I have read through this guide and it is ...
1
vote
2answers
291 views

Our company needs to conduct an audit of a large ASP.NET solution that was developed for us by a development company. [closed]

What professional standards and practices are recommended for guiding such an effort?
6
votes
2answers
197 views

Security Researchers: How do you choose what services or software you are going to audit next?

Security Researchers: How do you choose what services or software you are going to audit next? I am referring to finding vulnerabilities and developing exploits in various applications. I am ...
5
votes
2answers
510 views

Established Security Design Patterns?

In software engineering, a design pattern is a general reusable solution to a commonly occurring problem within a given context in software design. Wikipedia lists many different design patterns for ...
3
votes
2answers
1k views

What are the best IT auditing guidelines for Red Hat Linux 5.x+, including the critical data protection?

Currently, I am a junior application consultant and we are maintaining huge amounts of redhat machines as servers. I am given the chance and liberty by my boss (unbelieveable!) to go do my own ...
1
vote
3answers
334 views

What is the best way to get a third party audit done of website security?

I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and ...
2
votes
2answers
656 views

up2date tools for security audit linux / centos

I'm setting up a new CentOS 6 server and am looking into some security audit tools to validate my configuration and to point out weak spots in the server. There are a lot of non up2date tools out ...
0
votes
2answers
168 views

Looking for information about the job from security consultants

I'm graduating with my bachelor's in computer science in December, and I'm looking to get an internship in a security consultant firm for the summer, or apply as an analyst/associate in October. I've ...
1
vote
2answers
154 views

What due diligence is required for HTTPModules that run within IIS?

I noticed some HTTP Handlers in my Web.config that appear to intercept HTTP traffic and manipulate it. Since there has already been an exploit with a similar component produced by Microsoft, what ...
0
votes
1answer
285 views

Do Auditors use a specific methodology or framework when auditing IT Backup policy? [closed]

I am wondering if IT Auditors use a methodology or framework to audit a backup policy. Here is a example of a different kind incase my question does not make sence: ~~~~~~~~~~~~~~~~~~~~~~~~~ A ...