For questions about the assessment of hardware, software, systems, people, processes, projects, etc, that are somehow related to the security of an organization or product. Often these are related to a certification the organization or product holds, or looking for tools or processes for performing ...

learn more… | top users | synonyms (1)

3
votes
0answers
65 views

How to group user actions within the same session?

I'm working on enterprise application where it's needed to audit all user actions (data modification, settings changing etc.) within their work session. What is the best way to group all that actions ...
3
votes
0answers
119 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
2
votes
0answers
70 views

Finding Audit Reports and Results for Whole Disk Encryption Solutions

Due to TrueCrypt being pulled from the web even though it's been audited, I was asked to compare the audit of TrueCrypt against audits and information available for other products that do whole disk ...
2
votes
0answers
867 views

Using “Security Compliance Manager” to audit a Windows system

I found a few posts which suggest using Microsoft SCM (Security Compliance Manager) to audit the security of Microsoft software solutions: Windows security policy analysis tool How do I apply a ...
1
vote
0answers
49 views

Security event log entries missing values when generated from network access

With object auditing and directory audit settings correctly applied, all necessary file system access events are logged to the Security event log. When making changes locally (to C:\Share for example),...
1
vote
0answers
226 views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
1
vote
0answers
17 views

Get information about the audit state of software (for OSS)?

How does one go about to determine how well audited/checked a software is? To make this a much more specific question I am interested in ways to ascertain (mailing lists, rankings etc.) that a ...
1
vote
0answers
94 views

Why is Windows auditing svchost by default?

I would like to know why, by default, Windows set an audit rules on svchost.exe ? While it's used only when auditing is active, i don't understand why there's a special treatment for this file since ...
1
vote
0answers
86 views

Secure 'pg_settings' for PostgreSQL

I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB. I came across this url, have checked the same. Anything more to this?: ...
1
vote
0answers
133 views

secure authentication between subdomains hosted seperately

The web tools we are developing for a client require seamless interoperability with an existing user management sytem and commerce tools (the "mainsite"). The mainsite is built and maintained by a ...
0
votes
0answers
33 views

What defines a Secure Audit Log as such and how do you implement it?

What features would you expect from a secure audit log? Is there more than not being able to change it and make sure you know who wrote it? You do that by hashing the previous entry and signing the ...
0
votes
0answers
10 views

Where can I find sample logs/ loggin templates or generate them ?

I am trying to build an environment that will generate simple data, basically simulating small client environment. I have a tool that can generate data from sample log files and modify them/replay ...
0
votes
0answers
9 views

Determining which files a process modifies / creates with strace?

For purposes of setting up AppArmor or SE Linux, I'm looking to audit what files a program could possibly need access to. My understanding is that the end of AppArmor or SE Linux, is to constrain ...
0
votes
0answers
34 views

Process of auditd -s enable/disable persists for a long time

I have setup auditd on my system, with some basic rules from CIS Benchmark paper and the following auditd.conf file: log_file = /var/log/audit/audit.log log_format = RAW log_group = root ...
0
votes
0answers
29 views

Secure Systems Design Principles Excercise

I've been asked to find which Principles are being violated in this situation: I have the program "su" that is similar to the UNIX one (It gives you access to another user if you are a SuperUser, ...
0
votes
0answers
62 views

Tuning auditd to be more operational friendly

We are in the process of pushing for a passing SOC-2 audit report, and part of that is to get our auditing act together. Specific to what I'm working on right now auditd. I have a nice set of rules, ...
0
votes
0answers
65 views

Questions to confirm a good standpoint on web app security?

What should be the questions asked to assess a company on web app security? Our company is in process of partnering with another company in order to outsource web app security work to them. For us ...
0
votes
0answers
41 views

Security audit framework of Internet Explorer Outlook Web Access (OWA) add-on?

I'm working with a software company that has developed an add-on to Outlook Web Access. They are aggregating data and providing a consolidated view of a particular topic / category. I have experience ...