Evaluation of a person, organization, system, process, enterprise, project or product.
12
votes
2answers
721 views
Status of Trusted Computing and Remote Attestation deployment
Hardware support for various client-side controls based on Trusted Computing (Wikipedia) has been evolving over the years, e.g. TCPM, TPM, TXT (LaGrande, DRTM).
I've heard of one practical ...
6
votes
1answer
753 views
How to check the integrity of my BIOS?
Could it be possible that a virus rewrites my BIOS with some malicious code? If so, how could I protect against it, or at least how can I check that the BIOS hasn't been modified?
17
votes
2answers
9k views
Simple example auditd configuration?
Auditd was recommended in an answer to Linux command logging?
The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, ...
5
votes
8answers
5k views
How to simulate DDoS attacks from the Internet?
The idea behind security tests is easy. You want to know what a hacker can do - you hire a security expert who acts like a hacker to see how far he can get. You want to know what an evil admin can do ...
8
votes
5answers
3k views
Automated tools for Cisco IOS config auditing?
Are there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.
2
votes
3answers
253 views
Dealing with untrusted administrators in a Windows domain
I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
12
votes
5answers
491 views
How to get into RFID auditing?
I would like to get more knowledge around RFID-systems auditing.
Does anyone have a basic guide step-by-step which I can use to set up a lab with proper RFID "sniffing" equipment?
I would like to ...
10
votes
5answers
8k views
How to find out that a NIC is in promiscuous mode on a LAN?
How to find out that a NIC is in promiscuous mode on a LAN?
8
votes
5answers
670 views
How to review code for backdoors?
I have a codebase that needs a code review to evaluate it for backdoors.
The code is far too big to review it all, how would you recommend approaching the problem.
It is a java web application with ...
8
votes
4answers
613 views
What is an appropriate auditing standard for a law firm?
I'm an IT Admin at a law firm. We handle sensitive customer data and some health records. I'd really like to have an outside consultant assess our data security practices, but I'm not sure what to ask ...
4
votes
1answer
387 views
Do blackbox penetration tests make sense if a whitebox audit would be possible as well?
Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
