For questions about the assessment of hardware, software, systems, people, processes, projects, etc, that are somehow related to the security of an organization or product. Often these are related to a certification the organization or product holds, or looking for tools or processes for performing ...

learn more… | top users | synonyms (1)

38
votes
3answers
37k views

Simple example auditd configuration?

Auditd was recommended in an answer to Linux command logging? The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, stig....
35
votes
6answers
3k views

Is C a good choice for security-related software any longer? [closed]

C is a rock-solid and widespread programming language that is very popular especially in the FOSS community. Many security-related software (such as encryption libraries) are written in C and will ...
25
votes
6answers
2k views

How can security audits be integrated into an agile project?

If we give a security auditing company a working system, and ask them to audit it, and only do that once during a project because it's expensive, this is basically waterfall. How can security ...
23
votes
7answers
5k views

What stops a developer from accessing credit card details and other secret data from a company

First of all, I'm sorry if this has been discussed many times. I read many posts about PCI compliance but there are some small things I'm not quite sure about. Suppose there is Mr. GoodGuy, an ...
23
votes
7answers
4k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always written a short PDF quickly explaining what I encountered ...
20
votes
5answers
28k views

How to find out that a NIC is in promiscuous mode on a LAN?

How to find out that a NIC is in promiscuous mode on a LAN?
20
votes
5answers
22k views

How to simulate DDoS attacks from the Internet?

The idea behind security tests is easy. You want to know what a hacker can do - you hire a security expert who acts like a hacker to see how far he can get. You want to know what an evil admin can do -...
19
votes
6answers
727 views

What should I do when classified information stayed on a unauthorized laptop?

Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it? How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
18
votes
3answers
929 views

Any comments or advice on OWASP-2013 top 10 number A9

In this iteration of the OWASP top 10 application security vulnerabilities list (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project), a new category 'A9 Using Components with Known ...
18
votes
3answers
2k views

Status of Trusted Computing and Remote Attestation deployment

Hardware support for various client-side controls based on Trusted Computing (Wikipedia) has been evolving over the years, e.g. TCPM, TPM, TXT (LaGrande, DRTM). I've heard of one practical ...
14
votes
3answers
2k views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
13
votes
2answers
17k views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
13
votes
3answers
8k views

PostgreSQL Security Audit

Could anyone provide a good resource or check-list for a security review of PostgreSQL?
13
votes
5answers
1k views

How to get into RFID auditing?

I would like to get more knowledge around RFID-systems auditing. Does anyone have a basic guide step-by-step which I can use to set up a lab with proper RFID "sniffing" equipment? I would like to ...
12
votes
4answers
1k views

Carrying out a professional IT audit procedure

I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the ...
12
votes
2answers
638 views

What should I look for when auditing a Firefox extension / plugin?

I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert. What kinds of ...
11
votes
6answers
14k views

Automated tools for Cisco IOS config auditing? [closed]

Are there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.
10
votes
4answers
630 views

How can I audit which type of Block Mode encryption is being used when no source code is available?

Given that there are clear advantages to using some block modes of encryption over another, and I would like to ensure that all software used in the enterprise uses a certain "level" of security I'd ...
10
votes
2answers
859 views

Is it safe to store SSN's in Azure Cloud?

I'm doing due diligence on a company. They are entirely cloud based and need to collect lots of personal information from users (including SSN). Is this something I should be majorly concerned with? ...
9
votes
4answers
1k views

What is an appropriate auditing standard for a law firm?

I'm an IT Admin at a law firm. We handle sensitive customer data and some health records. I'd really like to have an outside consultant assess our data security practices, but I'm not sure what to ask ...
9
votes
3answers
570 views

How do I stop my IP from being resolved through my Skype?

I recently discovered that someone found out my current IP info via Skype among other information. People can do this via a thing called Skype resolvers. However nothing I do so far seems to work. I ...
9
votes
2answers
214 views

Breaching a computer knowing only IP when all ports closed - possible?

I'm checking my setup for security holes with some dedicated Linux distros. First thing I did was to scan all ports, and beyond that - it seems like it's pretty much unhackable. Since all ports were ...
8
votes
1answer
3k views

How to check the integrity of my BIOS?

Could it be possible that a virus rewrites my BIOS with some malicious code? If so, how could I protect against it, or at least how can I check that the BIOS hasn't been modified?
8
votes
2answers
654 views

How dangerous is it to use third-party security audit tools?

This question is inspired by two related questions (How safe is backtrack to use, and How to Install, Configure and Use LSAT on Unix SE). Besides a dated (and patched) vulnerability in LSAT (CVE-2007-...
8
votes
3answers
4k views

Bittorrent Sync encryption

Sync, a new product from BitTorrent, Inc., has been cited as a viable alternative to other cloud-storage platforms. The Sync FAQ indicates that an encryption scheme is being used, but does not comment ...
7
votes
5answers
2k views

How to review code for backdoors?

I have a codebase that needs a code review to evaluate it for backdoors. The code is far too big to review it all, how would you recommend approaching the problem. It is a java web application with ...
7
votes
3answers
4k views

What does a common workstation setup look like for pentesting and vulnerability research?

I'm a security enthusiast, and am in need of some guidance to get me into the branch. I've always been held back by lack of methodology in my research, and it tends to break down my motivation towards ...
7
votes
4answers
819 views

Firewall Reviews - What is in your Toolbox?

In the vein of the questions about forensics, I'd be interested to hear what tools/techniques people use on Firewall reviews, both in terms of periodic reviews as an auditor or consultant, or ...
7
votes
3answers
122 views

Is it possible to determine if the BIOS has been modified between two points in time?

Is it possible to determine if the BIOS of a computer has been modified between two points in time from that computer while it's running ? Effectively I'd like to be able to gather the equivalent of ...
7
votes
2answers
256 views

What criteria should be used for manually reviewing / prioritizing failed logins?

I have a web application that is exposed to the Internet, and am interested in creating alerts, or prioritizing the manual review of failed logins to the web application. What thresholds, or ...
7
votes
2answers
998 views

Established Security Design Patterns?

In software engineering, a design pattern is a general reusable solution to a commonly occurring problem within a given context in software design. Wikipedia lists many different design patterns for ...
7
votes
1answer
152 views

What should be included in the ground rules for an attack review?

I've drafted some ground rules for a call for adversarial attack-review. I've tried to cover the following topics: Link to the policy that I want to enforce. Link to a minimal testbed and ...
6
votes
4answers
845 views

Source code auditing and fake builds

I am wondering about source code auditing and how hard it would be to fake a build to be audited? Let me explain. Say I would be a dishonest programmer that would wish to put in some backdoor into ...
6
votes
3answers
483 views

When you make a revision of rules on a firewall, how do you add credibility/customer satisfaction to your final consideration?

When, for a vulnerability assessment, you need to report the security consideration about a firewall's configuration rule-set, after the audit on the rule-set you make a report about security concerns ...
6
votes
2answers
770 views

What a programmer should know before their web service's client audit

Situation: I have created a WS client (.net wcf) for the customer that access a third party web service (Websphere). This WS uses HTTPS and I get a certificate from WS vendor. All works fine, I have ...
6
votes
2answers
218 views

Security Researchers: How do you choose what services or software you are going to audit next?

Security Researchers: How do you choose what services or software you are going to audit next? I am referring to finding vulnerabilities and developing exploits in various applications. I am ...
6
votes
1answer
2k views

Should I only disable, but never delete an account from ActiveDirectory?

In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails. Is this a ...
6
votes
2answers
162 views

Software can be audited, is there an equivalent for hardware?

In software, code auditing can be used as a mean to gain trust into a software. Of course closed, proprietary software would complicate this, and require to do reverse engineering. Anyway there seems ...
6
votes
1answer
671 views

RKHunter and CHKRootkit Warns About /usr/lib/pymodules/python2.7/.path

In relation to my previous question. I have this Warning again from both RKHunter and Chkrootkit. My VPS has been turned off for how many weeks, until I turned it on again to deploy my website. After ...
6
votes
3answers
328 views

How do I secure my advertisement space against ad overlay browser attachments?

I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
6
votes
1answer
352 views

Are NTFS Alternate File Streams considered a security risk in your organisation; how is it mitigated?

Alternate File Streams allows a user to embed hidden content within any NTFS file. That file can be a TXT file, or MOV for example. Some may consider this a form of steganography, and therefore the ...
5
votes
4answers
2k views

Why is penetration testing important

In improving the security of an organization, it seems as though an audit of existing code, procedures, policies, infrastructure, etc. would be absolutely sufficient to reveal any security or policy ...
5
votes
3answers
574 views

Are Windows security updates audited?

An IT guy said that in his company, the Windows updates (small security updates that are downloaded automatically by the Windows autoupdate) are checked by the auditor. ie: the auditor checks if every ...
5
votes
3answers
104 views

How to check that passwords are not stored in a readable format

I'm writing a plan to audit my password policy, and I was stuck on one of my policy controls which was making sure that No password should be stored in a readable format. What is the best practice ...
5
votes
2answers
594 views

How to work effectively to win bug-bounties?

I really want to prove myself (to my parents) by winning a proper bug bounty How should I best prepare for this and go about actually finding bugs? Edit So can anyone give some web sites ...
5
votes
3answers
185 views

I want to have the security of my crypto code checked, how should I go about doing so?

Specifically part of my system stores encrypted information in a database. I wrote the code that actually does the encrypting/decrypting using an existing cipher. How should I go about making sure ...
5
votes
3answers
319 views

Is it reasonable to do a pentest (or other non-theoric security audit) over a critical infrastructure?

Almost all agree that during a pentest it is impossible to guarantee the integrity of the target (Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in ...
5
votes
2answers
3k views

Firewall Configuration Audits

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
5
votes
2answers
931 views

Security Scanning for Desktop Applications

Our company develops Windows desktop applications. We offer off the shelf solutions - not custom development. A potential new customer wants to add a section to our standard contract that requires ...
5
votes
2answers
490 views

Advice for writing my first application security review

I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...