For questions about the assessment of hardware, software, systems, people, processes, projects, etc, that are somehow related to the security of an organization or product. Often these are related to a certification the organization or product holds, or looking for tools or processes for performing ...

learn more… | top users | synonyms (1)

0
votes
1answer
37 views

Are the Linux community/universe repositories significantly less safe then the main repositories?

If so what makes community/universe less safe? Is there less testing or is it simply less safe because more people could put malware in them.
0
votes
0answers
33 views

What defines a Secure Audit Log as such and how do you implement it?

What features would you expect from a secure audit log? Is there more than not being able to change it and make sure you know who wrote it? You do that by hashing the previous entry and signing the ...
0
votes
0answers
10 views

Where can I find sample logs/ loggin templates or generate them ?

I am trying to build an environment that will generate simple data, basically simulating small client environment. I have a tool that can generate data from sample log files and modify them/replay ...
0
votes
0answers
10 views

Determining which files a process modifies / creates with strace?

For purposes of setting up AppArmor or SE Linux, I'm looking to audit what files a program could possibly need access to. My understanding is that the end of AppArmor or SE Linux, is to constrain ...
4
votes
2answers
51 views

Where do I start to learn more about a given company's or software solutions' security track record?

I don't personally have the resources or authority to audit for security issues all of the third-party services and companies I might want to use or be forced to use by business circumstances. How ...
2
votes
2answers
46 views

Does the use or the implementation of PDCA or Deming cycle in the Information Security Management System mandatory?

To comply with ISO 27001, does the Information Security Management System ought to implement the PDCA process ? or ISMS can choose another management method? PDCA process is the Plan Do Check and ...
2
votes
1answer
30 views

Is there any way to verify that an organization operating an open-source SaaS is using an untampered-with version of the software?

Some organizations have begun offering access to servers running open-source software (mail servers, chat servers), operated and maintained by those organizations, for a nominal recurring upkeep fee. ...
27
votes
1answer
3k views

Has malware ever been found in a package from a large Linux distribution and what is done to prevent this from occurring?

I am wondering exactly how safe are the Arch, Ubuntu, Mint and Manjaro repositories. What testing is done to ensure that a trusted user does not place a virus in a package, and how often?
1
vote
1answer
55 views

Security in transferring sensitive data over web apps

I am working on an app that has to transfer sensitive data over HTTPS and I have an idea but I am wondering if it is overkill or good. One of the issues is I need the ability to "share data" between ...
0
votes
1answer
33 views

Looking for some sort of system wide auditing tool [closed]

The title summarises it all but here's an example: You're sharing some hardware equipment with your dev colleagues, some days everything works well with it, the next day, nothing works anymore,...
0
votes
2answers
69 views

Certifying software as secure

What security certifications do major banks in the US expect an external software vendor to comply with? The software might form part of their payment processing system. ISO/IEC 27001 would apply to ...
2
votes
2answers
214 views

Auditing Event Logs of a System

Soon I will be acquiring the event logs of the systems my company produces and expected to audit them. Multiple logs are generated from each computer and there are multiple operating systems to audit. ...
39
votes
3answers
38k views

Simple example auditd configuration?

Auditd was recommended in an answer to Linux command logging? The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, stig....
0
votes
1answer
42 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
12
votes
4answers
1k views

Carrying out a professional IT audit procedure

I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the ...
3
votes
1answer
113 views

Why do several bug bounties ignore user enumeration?

While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
1
vote
1answer
118 views

How to pick an enterprise VPN provider?

We have always deployed our own VPN using an open source package, but as our company is growing we've become increasingly aware of the importance of scaling this solution, especially now we operate ...
3
votes
4answers
2k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
-1
votes
2answers
26 views

Security fails in private key and xor

I've implemented a very short program to encrypt a file, and send it on a remote server. First, I build a key based on a pass-phrase and a subset of prime numbers (the length of the key is defined by ...
5
votes
2answers
153 views

Are we obliged to provide a complete log should auditors ask for it?

We have a system that outputs and rotate logs on a daily basis. If an auditor requests us to provide logs of a particular date for a particular task, are we obliged to provide a complete full day ...
0
votes
1answer
83 views

Security considerations in storage of audit logs

How can I securely store audit logs of activity from a system such as together with source data or separately off site?
2
votes
0answers
121 views

Security Questions I should be asking my developers [closed]

I am looking for a comprehensive list of security related questions I should be asking my developers. I have done some research on the net and have yet to find a great list of questions I should be ...
5
votes
2answers
103 views

Use of automated security testing tools in the industry

I read this article about the 10 year old Finnish boy collecting a $10,000 bug bounty from Instagram with interest. According to the article (and I hope someone can shed more light on the exact ...
0
votes
0answers
35 views

Process of auditd -s enable/disable persists for a long time

I have setup auditd on my system, with some basic rules from CIS Benchmark paper and the following auditd.conf file: log_file = /var/log/audit/audit.log log_format = RAW log_group = root ...
0
votes
3answers
80 views

What are some metrics to be used to evaluate SaaS security?

Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others? In case it isn't obvious, the code is available to audit and measure.
0
votes
0answers
29 views

Secure Systems Design Principles Excercise

I've been asked to find which Principles are being violated in this situation: I have the program "su" that is similar to the UNIX one (It gives you access to another user if you are a SuperUser, ...
9
votes
3answers
600 views

How do I stop my IP from being resolved through my Skype?

I recently discovered that someone found out my current IP info via Skype among other information. People can do this via a thing called Skype resolvers. However nothing I do so far seems to work. I ...
3
votes
3answers
42 views

How do I demonstrate OpenSSH redhat/centos patchlevel to auditors?

A common problem is that Redhat backports security fixes leaving OpenSSH with an old, but not vulnerable, rpm version and ssh version string on Redhat and CentOS. This fools auditors. Apparently, the ...
0
votes
0answers
63 views

Tuning auditd to be more operational friendly

We are in the process of pushing for a passing SOC-2 audit report, and part of that is to get our auditing act together. Specific to what I'm working on right now auditd. I have a nice set of rules, ...
0
votes
1answer
73 views

What is Samba in simple terms? [closed]

Well basically a couple of days ago I decided to go on Omegle and one of the people I met seemed to be a troll and some point said why is my Samba protocol open. From this site they were able to get ...
10
votes
2answers
868 views

Is it safe to store SSN's in Azure Cloud?

I'm doing due diligence on a company. They are entirely cloud based and need to collect lots of personal information from users (including SSN). Is this something I should be majorly concerned with? ...
4
votes
1answer
49 views

Would generic exception messasges be considered a security risk?

For example, if visiting a webpage you get the response: Error in exception handler. This has a high chance the website is using Laravel. Would this class as information disclosure? I'm guessing ...
3
votes
1answer
180 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
1
vote
2answers
4k views

Best efficient windows hardening audit script [closed]

Do anyone know of a script that uses no third party executables (preferably a batch file) that can be used to audit windows machine state security wise? (including best practices features - gpo, ...
0
votes
7answers
2k views

Does ISP have control on all routers in their network?

When I was changing my router my ISP technician told me that he has remote access to all routers provided by ISP. Was that true? If that is a fact it scares me...
1
vote
0answers
50 views

Security event log entries missing values when generated from network access

With object auditing and directory audit settings correctly applied, all necessary file system access events are logged to the Security event log. When making changes locally (to C:\Share for example),...
35
votes
6answers
3k views

Is C a good choice for security-related software any longer? [closed]

C is a rock-solid and widespread programming language that is very popular especially in the FOSS community. Many security-related software (such as encryption libraries) are written in C and will ...
0
votes
2answers
75 views

How unsecure would I assume old PHP code is? [closed]

We have several websites that are client facing at a very large company. These websites do gather client information. They were written 6-7 years ago, quite possibly using a PHP/mysql code generator....
-2
votes
1answer
36 views

Router connected to my ethernet [duplicate]

I'm guessing that someone is bringing his router to provide wifi to his coworkers, by connecting it to a certain point on one of the 8 floors of my building, how can I know where is connected?
23
votes
7answers
5k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always written a short PDF quickly explaining what I encountered ...
1
vote
1answer
74 views

How to check third party code for Security? [closed]

This may be a very broad question. I am a software developer and from time to time we use third party components which may / may not be secure. Are there any basic things that I should check the ...
0
votes
1answer
83 views

Surveillance in the Workplace? [closed]

Auditing, surveillance and logging are typical and common place in the workplace, understandably so. These actions are crucial to establishing metrics and performance of the network and its resources. ...
2
votes
1answer
51 views

How to audit login on a Debian distribution if var/log was deleted

Last week I had a linux debian distribution accessible from Internet compromised through SSH for 24 hours. As far as I know the attacker could get root privileges and performed some malicious actions. ...
9
votes
2answers
231 views

Breaching a computer knowing only IP when all ports closed - possible?

I'm checking my setup for security holes with some dedicated Linux distros. First thing I did was to scan all ports, and beyond that - it seems like it's pretty much unhackable. Since all ports were ...
6
votes
1answer
698 views

RKHunter and CHKRootkit Warns About /usr/lib/pymodules/python2.7/.path

In relation to my previous question. I have this Warning again from both RKHunter and Chkrootkit. My VPS has been turned off for how many weeks, until I turned it on again to deploy my website. After ...
4
votes
1answer
122 views

Did KeePassX ever have an audit funding?

Did KeePassX ever had an Audit Funding like ex.: TrueCrypt? Or any other password manager?
1
vote
1answer
158 views

Strange SECCOMP entries for sshd in audit log

I've posted this over at ServerFault but haven't received a response over there. I'm not a security professional, but I'm curious as to what kind of attack this might be and how the attackers might be ...
-3
votes
1answer
44 views

Little bit confusing with nmap scan

I started MySQL with this command service mysql start and it worked pretty well. So: Using the netstat command, I found 127.0.0.1:3306 was in listening state, this is the MySQL service. So I did a ...
0
votes
1answer
64 views

Basis for “trusting” third party code and services

I remember reading an article mentioning, that third party services and code should not be trusted, meaning blind trust. So, i was thinking, everyone uses third party code in software development ...
3
votes
0answers
65 views

How to group user actions within the same session?

I'm working on enterprise application where it's needed to audit all user actions (data modification, settings changing etc.) within their work session. What is the best way to group all that actions ...