Evaluation of a person, organization, system, process, enterprise, project or product.
19
votes
7answers
1k views
What should a security audit report include?
Background
I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always wrote a short PDF quickly explaining what I encountered and ...
17
votes
2answers
9k views
Simple example auditd configuration?
Auditd was recommended in an answer to Linux command logging?
The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, ...
16
votes
5answers
470 views
What should I do when classified information stayed on a unauthorized laptop?
Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it?
How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
12
votes
2answers
721 views
Status of Trusted Computing and Remote Attestation deployment
Hardware support for various client-side controls based on Trusted Computing (Wikipedia) has been evolving over the years, e.g. TCPM, TPM, TXT (LaGrande, DRTM).
I've heard of one practical ...
12
votes
5answers
491 views
How to get into RFID auditing?
I would like to get more knowledge around RFID-systems auditing.
Does anyone have a basic guide step-by-step which I can use to set up a lab with proper RFID "sniffing" equipment?
I would like to ...
10
votes
5answers
8k views
How to find out that a NIC is in promiscuous mode on a LAN?
How to find out that a NIC is in promiscuous mode on a LAN?
10
votes
3answers
610 views
Carrying out a professional IT audit procedure
I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the ...
8
votes
4answers
613 views
What is an appropriate auditing standard for a law firm?
I'm an IT Admin at a law firm. We handle sensitive customer data and some health records. I'd really like to have an outside consultant assess our data security practices, but I'm not sure what to ask ...
8
votes
5answers
670 views
How to review code for backdoors?
I have a codebase that needs a code review to evaluate it for backdoors.
The code is far too big to review it all, how would you recommend approaching the problem.
It is a java web application with ...
8
votes
3answers
3k views
PostgreSQL Security Audit
Could anyone provide a good resource or check-list for a security review of PostgreSQL?
8
votes
5answers
3k views
Automated tools for Cisco IOS config auditing?
Are there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.
8
votes
2answers
270 views
How dangerous is it to use third-party security audit tools?
This question is inspired by two related questions (How safe is backtrack to use, and How to Install, Configure and Use LSAT on Unix SE).
Besides a dated (and patched) vulnerability in LSAT ...
7
votes
3answers
1k views
What does a common workstation setup look like for pentesting and vulnerability research?
I'm a security enthusiast, and am in need of some guidance to get me into the branch. I've always been held back by lack of methodology in my research, and it tends to break down my motivation towards ...
7
votes
1answer
113 views
What should be included in the ground rules for an attack review?
I've drafted some ground rules for a call for adversarial attack-review. I've tried to cover the following topics:
Link to the policy that I want to enforce.
Link to a minimal testbed and ...
7
votes
3answers
236 views
How do I secure my advertisement space against ad overlay browser attachments?
I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
6
votes
4answers
465 views
Why is penetration testing important
In improving the security of an organization, it seems as though an audit of existing code, procedures, policies, infrastructure, etc. would be absolutely sufficient to reveal any security or policy ...
6
votes
3answers
258 views
When you make a revision of rules on a firewall, how do you add credibility/customer satisfaction to your final consideration?
When, for a vulnerability assessment, you need to report the security consideration about a firewall's configuration rule-set, after the audit on the rule-set you make a report about security concerns ...
6
votes
1answer
753 views
How to check the integrity of my BIOS?
Could it be possible that a virus rewrites my BIOS with some malicious code? If so, how could I protect against it, or at least how can I check that the BIOS hasn't been modified?
6
votes
2answers
446 views
What a programmer should know before their web service's client audit
Situation: I have created a WS client (.net wcf) for the customer that access a third party web service (Websphere). This WS uses HTTPS and I get a certificate from WS vendor. All works fine, I have ...
5
votes
8answers
5k views
How to simulate DDoS attacks from the Internet?
The idea behind security tests is easy. You want to know what a hacker can do - you hire a security expert who acts like a hacker to see how far he can get. You want to know what an evil admin can do ...
5
votes
4answers
272 views
Source code auditing and fake builds
I am wondering about source code auditing and how hard it would be to fake a build to be audited? Let me explain.
Say I would be a dishonest programmer that would wish to put in some backdoor into ...
5
votes
3answers
286 views
Are Windows security updates audited?
An IT guy said that in his company, the Windows updates (small security updates that are downloaded automatically by the Windows autoupdate) are checked by the auditor. ie: the auditor checks if every ...
5
votes
2answers
965 views
Firewall Configuration Audits
I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
5
votes
2answers
165 views
Security Researchers: How do you choose what services or software you are going to audit next?
Security Researchers: How do you choose what services or software you are going to audit next?
I am referring to finding vulnerabilities and developing exploits in various applications. I am ...
5
votes
2answers
332 views
Established Security Design Patterns?
In software engineering, a design pattern is a general reusable solution to a commonly occurring problem within a given context in software design. Wikipedia lists many different design patterns for ...
5
votes
2answers
234 views
Advice for writing my first application security review
I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
5
votes
1answer
95 views
What are the resources that an auditor would need to access in read mode?
Here a more concrete question:
I am interested in documentation for an External Security Audit for ERP applications.
What are the types of External Security Audit for ERP applications?
What types ...
5
votes
1answer
251 views
Are NTFS Alternate File Streams considered a security risk in your organisation; how is it mitigated?
Alternate File Streams allows a user to embed hidden content within any NTFS file. That file can be a TXT file, or MOV for example. Some may consider this a form of steganography, and therefore the ...
4
votes
2answers
127 views
Is it correct to consider audits as exclusively “detective” in nature?
I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me. The instructor was discussing access control administration areas and began categorizing certain ...
4
votes
3answers
294 views
How can IT audit for installation of IIS Express?
IIS Express is a developer tool for Windows XP and higher which provides the full feature set of IIS, but without needing administrator rights.
I've seen discussion by some developers who are ...
4
votes
3answers
2k views
How do I configure nmap to verify my firewall is performing stateful packet inspection?
As part of a compliance audit, I need to run a routine scan that verifies that our firewalls are performing stateful packet inspection on incoming packets. I have a dedicated server outside our ...
4
votes
2answers
218 views
Keystrokes to text converter method? (from an audio file, from previously recorded sounds of keystrokes)
I have an e.g.: WAV file that contains the sounds of a man typing on his keyboard (English or any language)
How can I convert this WAV file to a TXT file? I mean are there any scripts/programs that ...
4
votes
1answer
298 views
What tools can be use for Security Auditing for Redhat
Are there any good tools that can be used for Security auditing of Redhat Linux.
That can audit all the critical areas of System and provide the detailed output of all the audited sections.
4
votes
1answer
105 views
Are we obliged to provide a complete log should auditors ask for it?
We have a system that outputs and rotate logs on a daily basis.
If an auditor requests us to provide logs of a particular date for a particular task, are we obliged to provide a complete full day ...
4
votes
1answer
387 views
Do blackbox penetration tests make sense if a whitebox audit would be possible as well?
Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
4
votes
1answer
86 views
Integrity check against package repository?
I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates.
From time to time I want to boot from a clean boot ...
4
votes
1answer
82 views
Managing a large amount of MBSA Results?
I am responsible for scanning and fixing issues on ~50 servers with Microsoft Baseline Security Analyzer (MBSA) version 2.2. Unfortunately, there is no out of the box way to manage multiple MBSA ...
4
votes
1answer
129 views
The Economics and White Hat Nature of NSS ExploitHub
This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
3
votes
4answers
260 views
What is the purpose of EICAR?
For as long as can remember, EICAR has been used to test for the presence of Antivirus systems in email, the file system, or other places.
Sometimes the AV solution is so far out of date, that its ...
3
votes
4answers
945 views
Problems during Pen-testing of SCADA systems
Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
3
votes
5answers
189 views
How can I easily determine if a website security company is reputable?
Is there a BBB-type listing or some other reputable badge I should look for when choosing someone to perform a security review?
3
votes
2answers
766 views
NSA RHEL5 Checklist
The NSA has came up with the "Guide to the Secure Conguration of
Red Hat Enterprise Linux 5" (http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2.pdf) I have read through this guide and it is ...
3
votes
1answer
501 views
Which Domain Administrator created file X on a Windows 2008 R2-based server?
Someone created a file (web.config) in a location that basically caused IIS to not work. Is there any way I can determine who created this file?
The creator/owner says "Domain Administrators".
...
3
votes
2answers
105 views
Security Scanning for Desktop Applications
Our company develops Windows desktop applications. We offer off the shelf solutions - not custom development. A potential new customer wants to add a section to our standard contract that requires ...
3
votes
1answer
547 views
Should I only disable, but never delete an account from ActiveDirectory?
In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails.
Is this a ...
3
votes
1answer
136 views
What useful security reports can be extracted from a Windows-based machine and its' related logs?
What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)?
Assuming I can aggregate them into a report what ...
3
votes
1answer
66 views
Is there any public information on audited Java open source projects?
I'm sure that there must have been any number of audits on common Java open source projects, many of them for governments or publicly-funded bodies.
Have any of the results been made public, so that ...
2
votes
3answers
459 views
Why would you do a password audit
I was thinking last night after reading an article about pen testing and security audits, why would you get a list of all the passwords for the company you are auditing and put them through a piece of ...
2
votes
3answers
253 views
Dealing with untrusted administrators in a Windows domain
I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
2
votes
3answers
151 views
I want to have the security of my crypto code checked, how should I go about doing so?
Specifically part of my system stores encrypted information in a database. I wrote the code that actually does the encrypting/decrypting using an existing cipher.
How should I go about making sure ...
