Evaluation of a person, organization, system, process, enterprise, project or product.

learn more… | top users | synonyms (1)

4
votes
2answers
425 views

Security Scanning for Desktop Applications

Our company develops Windows desktop applications. We offer off the shelf solutions - not custom development. A potential new customer wants to add a section to our standard contract that requires ...
3
votes
1answer
160 views

Is there any public information on audited Java open source projects?

I'm sure that there must have been any number of audits on common Java open source projects, many of them for governments or publicly-funded bodies. Have any of the results been made public, so that ...
5
votes
1answer
152 views

Integrity check against package repository?

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
13
votes
3answers
2k views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
2
votes
3answers
506 views

rancid like tool for config files [closed]

I need to be able to watch directories on our servers, and track changes to files as part of our audit compliance. I have adjusted auditd to watch the directories, and send all writes and attribute ...
2
votes
1answer
255 views

How much are security tools audited?

Just an open question to the security community at large because... well... the phpMyAdmin thing has made me more paranoid than usual... Specifically, I'm thinking about Kali Linux (ex-BackTrack). ...
1
vote
1answer
102 views

What audit procedures are applied to ENotaries and to the software they use?

From a theoretical standpoint, the very notion of an electronic notary - ENotary implies a host of problems related to biometrics, signature revocation, timestamping, keeping a reliable electronic ...
11
votes
2answers
474 views

What should I look for when auditing a Firefox extension / plugin?

I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert. What kinds of ...
1
vote
0answers
170 views

Which are appropiate tests to perform during an internal/LAN security audit? [closed]

In the internal network we know that controls are less strict than externally but in the other hand we know that lots of attacks come from the internal segment (unhappy workers, etc.) Which are ...
5
votes
4answers
596 views

Source code auditing and fake builds

I am wondering about source code auditing and how hard it would be to fake a build to be audited? Let me explain. Say I would be a dishonest programmer that would wish to put in some backdoor into ...
4
votes
1answer
129 views

Are we obliged to provide a complete log should auditors ask for it?

We have a system that outputs and rotate logs on a daily basis. If an auditor requests us to provide logs of a particular date for a particular task, are we obliged to provide a complete full day ...
2
votes
2answers
357 views

Suspect Exchange Server appears to be hacked. How to determine if it was a false positive?

Our security vendor detected that our client's CAS server was doing a nessus scan in the internal network. It's not uncommon for this vendor to issue a false positive, but I'm looking for general ...
1
vote
1answer
153 views

How does a PCI QSA audit a company?

Corporate setups are often complex with data centers in multiple locations, complex ACL's and networks setup between them. How does a PCI auditor actually audit the systems ? How does he get to know ...
21
votes
7answers
3k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always wrote a short PDF quickly explaining what I encountered and ...
1
vote
1answer
519 views

How to define audit controls responsibility? @ SIEM

I'm assigned to write procedural documentation for the SIEM use cases for the IT asset owners. For example, the procedures for selecting events indicating unauthorized access to user-mail box. I have ...
4
votes
1answer
2k views

What tools can be use for Security Auditing for Redhat

Are there any good tools that can be used for Security auditing of Redhat Linux. That can audit all the critical areas of System and provide the detailed output of all the audited sections.
8
votes
2answers
515 views

How dangerous is it to use third-party security audit tools?

This question is inspired by two related questions (How safe is backtrack to use, and How to Install, Configure and Use LSAT on Unix SE). Besides a dated (and patched) vulnerability in LSAT ...
1
vote
1answer
111 views

Who should I use for auditing/cerifying server software or specific deployment

Background: our company provides an online service. The service is provided both to general public, and to enterprise customers. Enterprise customers are signed on as part of sales efforts. We have ...
4
votes
1answer
241 views

Managing a large amount of MBSA Results?

I am responsible for scanning and fixing issues on ~50 servers with Microsoft Baseline Security Analyzer (MBSA) version 2.2. Unfortunately, there is no out of the box way to manage multiple MBSA ...
1
vote
2answers
158 views

Auditing EXEs to ensure buffer overflow protections are in place? (such as SEHOP, ASLR, and DEP)

According to this answer, it's possible to compile a GCC-based application without certain buffer overflow techniques. Perhaps this is even possible with Visual Studio. How can I audit a given EXE ...
2
votes
3answers
3k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
1
vote
3answers
1k views

using network switches to prevent malicious promiscuous mode usage

I was reading the wiki about promiscuous mode when I came across a piece of information here that suggests that one could use network switches to prevent malicious use of promiscuous mode. In the ...
6
votes
4answers
2k views

Why is penetration testing important

In improving the security of an organization, it seems as though an audit of existing code, procedures, policies, infrastructure, etc. would be absolutely sufficient to reveal any security or policy ...
1
vote
2answers
422 views

Printer Job Auditing

Is there a way to audit the actual contents of print jobs sent to a Windows 2008 / Windows 2012 print server? I'm not interested in the metadata (pages, username, datatime etc), but the job itself ...
0
votes
1answer
178 views

Windows security policy analysis tool [closed]

I have several security policy files (INF exported from different Windows machines) which I need to audit. Is there any automatic tool you know of, that can analyse those files according to best ...
4
votes
3answers
170 views

I want to have the security of my crypto code checked, how should I go about doing so?

Specifically part of my system stores encrypted information in a database. I wrote the code that actually does the encrypting/decrypting using an existing cipher. How should I go about making sure ...
3
votes
5answers
246 views

How can I easily determine if a website security company is reputable?

Is there a BBB-type listing or some other reputable badge I should look for when choosing someone to perform a security review?
2
votes
3answers
1k views

Why would you do a password audit

I was thinking last night after reading an article about pen testing and security audits, why would you get a list of all the passwords for the company you are auditing and put them through a piece of ...
0
votes
1answer
123 views

PCI onsite QSA Audit Review

Has anyone had any success using video recordings from ObserveIT during a PCI onsite QSA audit review? We are scheduled to be audited in a few months and are considering adding ObserveIT to ...
1
vote
1answer
117 views

Does the “Special Groups” feature in Vista, 2008, R2, and Windows 7 apply to File System access?

The Windows 2008R2 "Special Groups" feature allows for detailed tracking of domain administrators when they log into the machine. This is accomplished by editing a registry key or the LSA. Is there a ...
-1
votes
3answers
585 views

Code auditing and/or fuzzing - Books and resources

I've read the 'Shellcoder's Handbook' as well as 'The Art of Exploitation', and appreciated both a lot. Now I'm looking for additional resources delving into vulnerability spotting, code auditing, and ...
1
vote
2answers
851 views

Firewall audit log management tools [closed]

is there any free or open source tools that is able to collect audit logs from firewall in syslog format for monitoring purposes? There is 2 firewall in my organization and I would like to track ...
-2
votes
1answer
1k views

How to retrive domain account hashes from windows 2008 server? [closed]

I want to do password length audit of domain password using offline brute force analysis. I cannot find any domain hashes from local machines , I want an approach where i can retrieve these hashes ...
2
votes
2answers
1k views

NSA RHEL5 Checklist

The NSA has came up with the "Guide to the Secure Conguration of Red Hat Enterprise Linux 5" (http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2.pdf) I have read through this guide and it is ...
1
vote
2answers
385 views

Our company needs to conduct an audit of a large ASP.NET solution that was developed for us by a development company. [closed]

What professional standards and practices are recommended for guiding such an effort?
6
votes
2answers
208 views

Security Researchers: How do you choose what services or software you are going to audit next?

Security Researchers: How do you choose what services or software you are going to audit next? I am referring to finding vulnerabilities and developing exploits in various applications. I am ...
7
votes
2answers
628 views

Established Security Design Patterns?

In software engineering, a design pattern is a general reusable solution to a commonly occurring problem within a given context in software design. Wikipedia lists many different design patterns for ...
3
votes
2answers
1k views

What are the best IT auditing guidelines for Red Hat Linux 5.x+, including the critical data protection?

Currently, I am a junior application consultant and we are maintaining huge amounts of redhat machines as servers. I am given the chance and liberty by my boss (unbelieveable!) to go do my own ...
1
vote
3answers
397 views

What is the best way to get a third party audit done of website security?

I have a website that needs to be PCI compliant. I have coded it using the guidelines but to be safe i wanted to get a third party audit done where this individual who runs a IT security firm and ...
2
votes
2answers
769 views

up2date tools for security audit linux / centos

I'm setting up a new CentOS 6 server and am looking into some security audit tools to validate my configuration and to point out weak spots in the server. There are a lot of non up2date tools out ...
0
votes
2answers
183 views

Looking for information about the job from security consultants

I'm graduating with my bachelor's in computer science in December, and I'm looking to get an internship in a security consultant firm for the summer, or apply as an analyst/associate in October. I've ...
1
vote
2answers
160 views

What due diligence is required for HTTPModules that run within IIS?

I noticed some HTTP Handlers in my Web.config that appear to intercept HTTP traffic and manipulate it. Since there has already been an exploit with a similar component produced by Microsoft, what ...
0
votes
1answer
315 views

Do Auditors use a specific methodology or framework when auditing IT Backup policy? [closed]

I am wondering if IT Auditors use a methodology or framework to audit a backup policy. Here is a example of a different kind incase my question does not make sence: ~~~~~~~~~~~~~~~~~~~~~~~~~ A ...
1
vote
0answers
232 views

What is the best way to manage temporary accounts on Active Directory [closed]

The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
7
votes
3answers
3k views

What does a common workstation setup look like for pentesting and vulnerability research?

I'm a security enthusiast, and am in need of some guidance to get me into the branch. I've always been held back by lack of methodology in my research, and it tends to break down my motivation towards ...
1
vote
1answer
773 views

Windows Session Recording Software

I'm trying to monitor connections and actions made by administrators (or any user connecting) to a server through TSE (i'm simplifying). I've heard about a software which can record a video of any ...
1
vote
2answers
3k views

Best efficient windows hardening audit script [closed]

Do anyone know of a script that uses no 3rd party executables (preferably a batch file) that can be used to audit windows machine state securitywise? (including best practices features - gpo, ...
3
votes
3answers
2k views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
6
votes
3answers
285 views

How do I secure my advertisement space against ad overlay browser attachments?

I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
3
votes
4answers
439 views

What is the purpose of EICAR?

For as long as can remember, EICAR has been used to test for the presence of Antivirus systems in email, the file system, or other places. Sometimes the AV solution is so far out of date, that its ...