Evaluation of a person, organization, system, process, enterprise, project or product.

learn more… | top users | synonyms (1)

-2
votes
3answers
185 views

How do I communicate security issues encountered on an online banking platform?

Occasionally, I've produced (and reproduced) the HTTP 500 Internal Server Error on an online banking platform - quite a famous one. I suppose the errors are due to bugs in back end code, possibly ...
36
votes
6answers
4k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole ? ...
3
votes
1answer
107 views

BYOD - Looking for Secure means of Wiping Data Remotely

We are in the process of implementing a Bring Your Own Device policy to allow our many employees to use their personal laptops and desktops (Windows platform) to VPN into our company's network. These ...
1
vote
1answer
282 views

Multi Tenant Database - HIPAA

We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) ...
3
votes
2answers
192 views

Password capturing from dump file or browser after log out

I am working on web application security auditing. I was going through various checklists & methodology. I found one interesting stuff in a document. Type - Configuration Management Security ...
5
votes
3answers
2k views

Bittorrent Sync encryption

Sync, a new product from BitTorrent, Inc., has been cited as a viable alternative to other cloud-storage platforms. The Sync FAQ indicates that an encryption scheme is being used, but does not comment ...
4
votes
1answer
207 views

Installing profile on “Good” Mail application give someone admin permission on my iPhone

My new enterprise use the app "GOOD" for the emails. But to use it, I have to install a GOOD profile with description : "Install this profile to enroll to encrypted profile service". If I choose ...
2
votes
1answer
337 views

RKHunter and CHKRootkit Warns About /usr/lib/pymodules/python2.7/.path

In relation to my previous question. I have this Warning again from both RKHunter and Chkrootkit. My VPS has been turned off for how many weeks, until I turned it on again to deploy my website. After ...
1
vote
0answers
32 views

Why is Windows auditing svchost by default?

I would like to know why, by default, Windows set an audit rules on svchost.exe ? While it's used only when auditing is active, i don't understand why there's a special treatment for this file since ...
2
votes
1answer
2k views

How to crack SHA512 hexdigest passwords with John the Ripper?

I've been playing with John The Ripper (JtR) to try to crack/audit a salted password that was hashed with SHA-512, with 20 interactions according to the source (for the curious, this is a Rails app, ...
0
votes
1answer
40 views

programs or methods to review Internet browser applications for security [closed]

I've been tasked with doing a security review on a Firefox update, but we don't have any utilities that we can find. How would we go about running a security review on Firefox before pushing it to ...
2
votes
1answer
215 views

How can I prove to a third party that I'm sending the emails I'm supposed to?

Suppose one of my duties for a small organization is to send out statements to clients by email. Suppose one of the directors / owners / trustees want to be able to audit the numbers. Specifically he ...
1
vote
0answers
49 views

Secure 'pg_settings' for PostgreSQL

I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB. I came across this url, have checked the same. Anything more to this?: ...
0
votes
6answers
747 views

Does ISP have control on all routers in their network?

When I was changing my router my ISP technician told me that he has remote access to all routers provided by ISP. Was that true? If that is a fact it scares me...
2
votes
1answer
354 views

Extracting the GPG userid from the Public key file?

Is it possible to extract userid from GPG public key? I got public key only and want to know to whom it might belong. I find one possible workaround — to publish this information on keyserver — it ...
1
vote
1answer
91 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
0
votes
3answers
237 views

How to safely mirror network traffic for audit reasons?

We have an internet connection that we need to audit: INTERNET ->> ROUTER ->> CLIENTS our idea would be to put a (enough big) HUB before the router (router, that logs in via pppoe to ...
3
votes
1answer
648 views

SCADA, ICS Specfic Testing Tools and Methodologies

I have been contracted to perform a security risk assessment that relates specifically to ICS and SCADA systems. I have performed many IT security risk assessments, however, I am new to assessing ...
1
vote
2answers
629 views

Basic Security Knowledge [closed]

Perhaps I am being both naive and overly ambitious in my first post but I have a huge interest in learning about network and system security and am at a loss as to where to begin. I realize that stack ...
7
votes
2answers
232 views

What criteria should be used for manually reviewing / prioritizing failed logins?

I have a web application that is exposed to the Internet, and am interested in creating alerts, or prioritizing the manual review of failed logins to the web application. What thresholds, or ...
2
votes
2answers
2k views

Is there any useful Android app for security assessments? [closed]

I've been thinking for a while about whether or not ask this, as it may be a opinion-based question, but as I have seen a couple of non-closed questions about recommended books, so I think this is the ...
2
votes
2answers
190 views

How can I be sure my former employer no longer has access to my computer? [closed]

How can I be sure now that I no longer work for a certain company that they are not accessing my computer from their side. Strange things happen ( someone remove a certain set of my friends on ...
-1
votes
1answer
267 views

How secure are the new TLDs ( .us, .io, …) and do they compare to .com? [closed]

The introduction of the new top level domains (TLDs) such as .music, .books, etc. will increase the number of people and organisations adding and removing entries into the root DNS servers (.) for ...
4
votes
2answers
125 views

How do I montior exactly what a program does? [closed]

I would like to run some program, preferably in a sandbox, and see exactly what it does/did. I'm currently puzzled by disk access and network, since there's so much other stuff happening there at the ...
1
vote
2answers
439 views

Why is my Mac trying to connect to an http://akamai.com server

I am running a properly configured pf_config ( at least, sort of properly configured ) and have wiped my hard drive clean 3 times with a fresh install of OSX Maverick. I find it odd that my laptop ...
2
votes
2answers
2k views

How to detect NAT - network address translation?

How to detect if NAT is used in network or not ? I know if you have private address and you are able to connect public network or internet then there must be NAT. But How can I detect that NAT is ...
2
votes
5answers
625 views

Vulnerability Scanner vs Security Audit

I have a web app, and customers who are concerned about the security of the app. I want to be able to give my potential customers (manufacturing companies with 2k-10k employees) confidence that our ...
4
votes
2answers
126 views

Could server honesty be audited by remote peers without said peers having sole (or any) control of the server?

Suppose for some reason, you and your peers absolutely positively have know that a server is acting honestly. Could the server behaviour be audited remotely through some mechanism of randomly ...
3
votes
3answers
206 views

What is the job of an IT auditor?

I am going through training in information security, as a part of the course they included compliance standards like: PCI DSS ISO 27001-2005 Cobit framework So after searching over Google, I came ...
1
vote
1answer
156 views

Which are open problems on policy-based access control system?

I'm working on access control system and on analysis tools for reasoning on it. In A.C. system based on policy, think about XACML specifications, the overall behaviour of the system cannot be clearly ...
18
votes
3answers
703 views

Any comments or advice on OWASP-2013 top 10 number A9

In this iteration of the OWASP top 10 application security vulnerabilities list (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project), a new category 'A9 Using Components with Known ...
2
votes
2answers
1k views

Finding out whether a website uses unsalted MD5 for password hashing

I'm working on a project where websites are analyzed and rated according to password security (factors like min/max password length, alphabet size and more are then calculated into a score). A great ...
1
vote
0answers
92 views

secure authentication between subdomains hosted seperately

The web tools we are developing for a client require seamless interoperability with an existing user management sytem and commerce tools (the "mainsite"). The mainsite is built and maintained by a ...
4
votes
3answers
222 views

Is it reasonable to do a pentest (or other non-theoric security audit) over a critical infrastructure?

Almost all agree that during a pentest it is impossible to guarantee the integrity of the target (Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in ...
-1
votes
2answers
153 views

ISMS for SMB (Small And Medium Enterprise)? [closed]

Is there an Information Security Management System (ISMS) existing for SME/ SMB, if not why ? The so called GRC suites are mainly targeted towards Fortune 100 (may be up to fortune 1000) companies , ...
4
votes
1answer
175 views

auditing open source compiler binaries for trojans

It is a well known vulnerability that a properly altered compiler binary can transfer itself to new binaries of the compiler, and still be entirely absent from the source code. But how real is this ...
4
votes
3answers
1k views

MS-SQL Monitoring/Auditing of PHI for HIPAA

We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the ...
4
votes
3answers
364 views

Is it necessary to test all input parameters of a web application when testing its security?

We know that testing input parameters for lack of validation is one part of a black box web vulnerability assessment but, is it necessary to test ALL input parameters (parameters, cookies, HTTP ...
10
votes
4answers
473 views

How can I audit which type of Block Mode encryption is being used when no source code is available?

Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
4
votes
1answer
2k views

How can I misuse the information of DCE service enumeration?

Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information: 192.168.1.23 - UUID ...
0
votes
4answers
169 views

Control over IT security

In pharmacy the safety of drugs is under fairly tight control by national authorities, e.g. FDA in US. The risks of patients taking drugs are thus very effectively minimized, though understandably ...
3
votes
1answer
461 views

Auditing, accounting, logging, and accountability… What's the difference?

Let's first look at the book Microsoft Windows Security Essentials: ... the three As (AAA) of security: authentication, authorization, and accounting ... they combine to contribute to reliable ...
3
votes
1answer
220 views

How do you evaluate and audit Central Authentication Service (CAS)?

This is in reference to Jasig's CAS software and I'm looking for a checklist to audit the state of security of a CAS implementation. While the Jasig site has a lot of documentation and their mailing ...
4
votes
2answers
405 views

Security Scanning for Desktop Applications

Our company develops Windows desktop applications. We offer off the shelf solutions - not custom development. A potential new customer wants to add a section to our standard contract that requires ...
3
votes
1answer
157 views

Is there any public information on audited Java open source projects?

I'm sure that there must have been any number of audits on common Java open source projects, many of them for governments or publicly-funded bodies. Have any of the results been made public, so that ...
5
votes
1answer
146 views

Integrity check against package repository?

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
13
votes
3answers
2k views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
2
votes
3answers
491 views

rancid like tool for config files [closed]

I need to be able to watch directories on our servers, and track changes to files as part of our audit compliance. I have adjusted auditd to watch the directories, and send all writes and attribute ...
2
votes
1answer
252 views

How much are security tools audited?

Just an open question to the security community at large because... well... the phpMyAdmin thing has made me more paranoid than usual... Specifically, I'm thinking about Kali Linux (ex-BackTrack). ...
1
vote
1answer
101 views

What audit procedures are applied to ENotaries and to the software they use?

From a theoretical standpoint, the very notion of an electronic notary - ENotary implies a host of problems related to biometrics, signature revocation, timestamping, keeping a reliable electronic ...