Evaluation of a person, organization, system, process, enterprise, project or product.

learn more… | top users | synonyms (1)

1
vote
2answers
154 views

What due diligence is required for HTTPModules that run within IIS?

I noticed some HTTP Handlers in my Web.config that appear to intercept HTTP traffic and manipulate it. Since there has already been an exploit with a similar component produced by Microsoft, what ...
0
votes
1answer
285 views

Do Auditors use a specific methodology or framework when auditing IT Backup policy? [closed]

I am wondering if IT Auditors use a methodology or framework to audit a backup policy. Here is a example of a different kind incase my question does not make sence: ~~~~~~~~~~~~~~~~~~~~~~~~~ A ...
1
vote
0answers
213 views

What is the best way to manage temporary accounts on Active Directory [closed]

The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
7
votes
3answers
2k views

What does a common workstation setup look like for pentesting and vulnerability research?

I'm a security enthusiast, and am in need of some guidance to get me into the branch. I've always been held back by lack of methodology in my research, and it tends to break down my motivation towards ...
1
vote
1answer
606 views

Windows Session Recording Software

I'm trying to monitor connections and actions made by administrators (or any user connecting) to a server through TSE (i'm simplifying). I've heard about a software which can record a video of any ...
0
votes
2answers
2k views

Best efficient windows hardening audit script [closed]

Do anyone know of a script that uses no 3rd party executables (preferably a batch file) that can be used to audit windows machine state securitywise? (including best practices features - gpo, ...
3
votes
3answers
836 views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
6
votes
3answers
276 views

How do I secure my advertisement space against ad overlay browser attachments?

I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
3
votes
4answers
335 views

What is the purpose of EICAR?

For as long as can remember, EICAR has been used to test for the presence of Antivirus systems in email, the file system, or other places. Sometimes the AV solution is so far out of date, that its ...
4
votes
1answer
139 views

The Economics and White Hat Nature of NSS ExploitHub

This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
15
votes
5answers
13k views

How to simulate DDoS attacks from the Internet?

The idea behind security tests is easy. You want to know what a hacker can do - you hire a security expert who acts like a hacker to see how far he can get. You want to know what an evil admin can do ...
2
votes
1answer
208 views

Detecting Key Loggers

We know that key loggers are the most effective and most annoying means of getting compromised over login id/password on the web or any application.... and your whole privacy is breached. Is there ...
4
votes
1answer
592 views

Do blackbox penetration tests make sense if a whitebox audit would be possible as well?

Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
4
votes
1answer
1k views

Should I only disable, but never delete an account from ActiveDirectory?

In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails. Is this a ...
3
votes
1answer
176 views

What useful security reports can be extracted from a Windows-based machine and its' related logs?

What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)? Assuming I can aggregate them into a report what ...
3
votes
1answer
873 views

Which Domain Administrator created file X on a Windows 2008 R2-based server?

Someone created a file (web.config) in a location that basically caused IIS to not work. Is there any way I can determine who created this file? The creator/owner says "Domain Administrators". ...
11
votes
3answers
869 views

Carrying out a professional IT audit procedure

I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the ...
5
votes
2answers
318 views

Advice for writing my first application security review

I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
7
votes
1answer
122 views

What should be included in the ground rules for an attack review?

I've drafted some ground rules for a call for adversarial attack-review. I've tried to cover the following topics: Link to the policy that I want to enforce. Link to a minimal testbed and ...
17
votes
5answers
543 views

What should I do when classified information stayed on a unauthorized laptop?

Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it? How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
22
votes
3answers
17k views

Simple example auditd configuration?

Auditd was recommended in an answer to Linux command logging? The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, ...
5
votes
2answers
2k views

Firewall Configuration Audits

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
16
votes
3answers
1k views

Status of Trusted Computing and Remote Attestation deployment

Hardware support for various client-side controls based on Trusted Computing (Wikipedia) has been evolving over the years, e.g. TCPM, TPM, TXT (LaGrande, DRTM). I've heard of one practical ...
4
votes
2answers
251 views

Keystrokes to text converter method? (from an audio file, from previously recorded sounds of keystrokes)

I have an e.g.: WAV file that contains the sounds of a man typing on his keyboard (English or any language) How can I convert this WAV file to a TXT file? I mean are there any scripts/programs that ...
7
votes
1answer
1k views

How to check the integrity of my BIOS?

Could it be possible that a virus rewrites my BIOS with some malicious code? If so, how could I protect against it, or at least how can I check that the BIOS hasn't been modified?
8
votes
5answers
1k views

How to review code for backdoors?

I have a codebase that needs a code review to evaluate it for backdoors. The code is far too big to review it all, how would you recommend approaching the problem. It is a java web application with ...
12
votes
5answers
15k views

How to find out that a NIC is in promiscuous mode on a LAN?

How to find out that a NIC is in promiscuous mode on a LAN?
2
votes
1answer
234 views

Is the Gmail activity log still missing activesync?

Is the Gmail activity log still missing activesync as described in this blog post? As it is "someone with my credentials could be reading and sending [email] messages with my account" without that ...
4
votes
2answers
140 views

Is it correct to consider audits as exclusively “detective” in nature?

I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me. The instructor was discussing access control administration areas and began categorizing certain ...
3
votes
4answers
1k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
4
votes
3answers
370 views

How can IT audit for installation of IIS Express?

IIS Express is a developer tool for Windows XP and higher which provides the full feature set of IIS, but without needing administrator rights. I've seen discussion by some developers who are ...
6
votes
3answers
298 views

When you make a revision of rules on a firewall, how do you add credibility/customer satisfaction to your final consideration?

When, for a vulnerability assessment, you need to report the security consideration about a firewall's configuration rule-set, after the audit on the rule-set you make a report about security concerns ...
4
votes
3answers
3k views

How do I configure nmap to verify my firewall is performing stateful packet inspection?

As part of a compliance audit, I need to run a routine scan that verifies that our firewalls are performing stateful packet inspection on incoming packets. I have a dedicated server outside our ...
11
votes
3answers
5k views

PostgreSQL Security Audit

Could anyone provide a good resource or check-list for a security review of PostgreSQL?
9
votes
4answers
839 views

What is an appropriate auditing standard for a law firm?

I'm an IT Admin at a law firm. We handle sensitive customer data and some health records. I'd really like to have an outside consultant assess our data security practices, but I'm not sure what to ask ...
9
votes
6answers
6k views

Automated tools for Cisco IOS config auditing?

Are there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.
6
votes
2answers
533 views

What a programmer should know before their web service's client audit

Situation: I have created a WS client (.net wcf) for the customer that access a third party web service (Websphere). This WS uses HTTPS and I get a certificate from WS vendor. All works fine, I have ...
12
votes
5answers
797 views

How to get into RFID auditing?

I would like to get more knowledge around RFID-systems auditing. Does anyone have a basic guide step-by-step which I can use to set up a lab with proper RFID "sniffing" equipment? I would like to ...
5
votes
3answers
348 views

Are Windows security updates audited?

An IT guy said that in his company, the Windows updates (small security updates that are downloaded automatically by the Windows autoupdate) are checked by the auditor. ie: the auditor checks if every ...
5
votes
1answer
289 views

Are NTFS Alternate File Streams considered a security risk in your organisation; how is it mitigated?

Alternate File Streams allows a user to embed hidden content within any NTFS file. That file can be a TXT file, or MOV for example. Some may consider this a form of steganography, and therefore the ...
5
votes
1answer
107 views

What are the resources that an auditor would need to access in read mode?

Here a more concrete question: I am interested in documentation for an External Security Audit for ERP applications. What are the types of External Security Audit for ERP applications? What types ...