Specific to logging of alerts, activities and actions
139
votes
18answers
7k views
Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
21
votes
3answers
1k views
What access does UK Police currently have to ISP logs, and what information can said logs provide?
I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
5
votes
4answers
2k views
What logs to retain for PCI-DSS?
I am using Splunk to centrally collect all of my logs for PCI-DSS. I'm running into my licensed volume limit and I need to know exactly what needs to be retained for regulatory compliance.
I am ...
0
votes
0answers
39 views
Are too many logfiles in the apachelog slowing down the server? [migrated]
At my webserver, I have separate logfiles for all my over 250 domains.
Is this showing the server down? Would it be faster to have only one logfile that contains all access-logs?
5
votes
2answers
126 views
What are the parameters to be logged in a web application?
I am working on developing a secure authentication system with SSO. Until now I have been using the logging framework to generate logs that help in debugging the application. I wonder if there is a ...
4
votes
5answers
359 views
Should an invalid user name be logged?
While authenticating, should attempts with invalid user names be logged? OWASP Logging Cheat Sheet says that authentication failures must always be logged. I can observe several programs doing this, ...
0
votes
3answers
91 views
Odd Server Logs
I have a webapp running using Django. I recently activated some middleware which is supposed to alert me of 404's where the referrer is within my domain (supposedly indicating a 404 that is my fault).
...
0
votes
1answer
372 views
Penetration testing job entry exam [closed]
What type of hands on tests should I expect in a interview for a entry level penetration tester?
And what do examiners expect a candidate to accomplish (i.e. full compromise)?
The reason I ask is ...
4
votes
2answers
245 views
How can I find out who owns a block of IPs?
I'm currently going through the logs on my apache install for potential intrustions, and I'm finding a lot of hits for SQL injections and exploit testing, from 173.212.195.* . I'm now trying to find ...
4
votes
1answer
103 views
Are we obliged to provide a complete log should auditors ask for it?
We have a system that outputs and rotate logs on a daily basis.
If an auditor requests us to provide logs of a particular date for a particular task, are we obliged to provide a complete full day ...
1
vote
1answer
52 views
Should users share OSX crash logs?
OSX stores app crash logs into ~/Library/Logs/DiagnosticLogs/appname_date.crash and optionally submits these anonymously back to Apple.
These contain a fair amount of debug info for the developer, ...
3
votes
2answers
194 views
How to satisfy requirement 10.6 of PCI DSS?
The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
8
votes
1answer
314 views
How can I secure my log files?
I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I ...
1
vote
1answer
151 views
How to find IPS events in sonicwall syslog
I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
3
votes
3answers
314 views
Honeyd: log grows too fast
I'm having trouble with honeyd log; it grows way too fast. I started the honeyd daemon with
honeyd -l /var/log/honeypot/honey.log -u 1000 -g 1000 -f honeyd.conf
/var/log/honeypot/honey.log is 1+ ...
0
votes
1answer
105 views
SSH Log: “Accepted password for user…”
I have only port 29999 open for SSH connections. But in the log file I see entries like this:
Accepted password for user1 from 190.101.200.100 port 55805 ssh2
saying that a connection was accepted ...
1
vote
2answers
2k views
Find the hack in the Apache2 logs?
The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss).
So I looked in the Apache2 logs and ...
0
votes
2answers
117 views
Improve SSH logs
I want to improve my SSH log. I would like to basically be able to see failed attempts with ip address and the password used. is that possible?
Right now I see something like this:
Failed password ...
-1
votes
3answers
146 views
How information in an access log could be used to identify the true identity of an impostor?
Is it possible to use information in an access log to identify the true identity of an impostor who has acquired unauthorized access to a computing system (Perhaps by combining several different ...
1
vote
1answer
186 views
Silent (no user interaction) utility to clear cached credentials on Windows [closed]
Is there any way to clear cached credentials on Windows, that doesn't require:
user interaction (e.g. a confirmation window);
administrator access; or
making a persistent change to the ...
1
vote
1answer
474 views
By default, does a linksys router log connections?
Routers have many settings that allow it to be safe and secure for the users that are connected to that network. A lot of these settings have to be manually configured though, which includes ...
7
votes
1answer
120 views
Why would it be preferable for a system to shut down when the security log is full?
When running in a configuration that supports Common Criteria, Windows must be configured to shut down when the security event log is full. Why is this a preferable option?
0
votes
2answers
192 views
Monitoring access logs of Web application [closed]
Is there any open source framework or libraries which can provide security monitoring capabilities for Web application by analyzing Web application access logs. Basically i need to monitor and analyze ...
3
votes
1answer
157 views
How to design SIEM RFP, keeping in view large database requirements?
I need some help regarding the design of SIEM requirments. In regard to large databases, what general requirements do I need to provide in order to provide coverage related to DB security?
Some of ...
0
votes
1answer
91 views
SIEM technology is it database friendly? [closed]
I have a few questions regarding the use of Databases in SIEM technology. I would appreciate if you guys can help me understand / answer these questions. The answers from you help me design the SIEM ...
3
votes
2answers
290 views
Setup and record outbound traffic from a botnet in a sandbox/secure environment
How do I record the outbound 'attack' traffic from a botnet on a Windows XP machine? The captured traffic will be in the Windows XP firewall log.
I need to setup some kind of an experiment where I ...
3
votes
2answers
145 views
What is the benefit of combining different web log files with different formats?
What is the benefit of combining different web log files with different formats in terms of web application security? In other words, how does combining iis log file with apache log file help in ...
12
votes
5answers
721 views
Is it legal to log passwords from failed logins?
Is it legal to store/log mistyped passwords?
How many of you have seen this happen in a log file or DB?
3
votes
2answers
290 views
intrusion detection on own hotspot?
Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts?
For example, a log like this:
TIME DATA - ...
10
votes
2answers
733 views
Security of Log Files - Injecting malicious code in Log files
As part of my course project I'm trying to understand various security frameworks and best practices.
One of the very popular approach is to maintain Logs. My question is about the security of the ...
3
votes
5answers
380 views
Is it wrong to collect and store IP addresses?
I am developing a PHP analytics program. I am using IP addresses to get its corresponding country. I was wondering if its OK to store both the IP address and Country or if its better if I just store ...
3
votes
2answers
176 views
Do LAMP log files sometimes contain sensitive information?
I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
1
vote
2answers
297 views
How to make database of IP addresses anonymous?
I have to perform ip address connection stats anonymously because the data posses security risk, so how do I do it?
Is it just like this, that the ip numbers and networks are replaced by random ...
2
votes
1answer
780 views
Snort & Logging
I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me.
I would like to use Snort to perform a trace, which, after it ...
4
votes
7answers
642 views
What is the best way to securely keep clear passwords?
I'm working on a web project that will connect to a database. For that, I will have to store the login/password of that database user in clear (encrypted in a symmetrical way) in order to be able to ...
2
votes
1answer
471 views
Analyzing wireshark results (openvpn)
I signed up to Mullvad for VPN service, and manually run OpenVPN from my Linux box.
I rebooted my computer and make sure not to start any OpenVPN service. Yet when I did a Wireshark analysis I am ...
2
votes
2answers
165 views
What may a Hungarian employer do with the employee monitoring logs?
Employers often monitor employee network access, even install keyloggers on their computers, etc.
But the articles I found on the internet, is about the monitoring but not what they may do with the ...
6
votes
4answers
217 views
Finding date of last network access
I have a system that contains highly sensitive data that does not reside on the Internet. However, when I was going through the machine recently, I detected that it had cookies, and temporary internet ...
3
votes
4answers
3k views
What are the laws regarding ISP recording IP addresses? How would they know who had which?
Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address ...
8
votes
3answers
568 views
How do I log all my internet-connections
How can I (maybe with a proxy, but I need names of programs!?) log all my interactions of programs with my Internet connection, so that I could see WHAT a program is sending and WHAT it is receiving. ...
8
votes
5answers
1k views
Privacy issues with email providers
I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
0
votes
3answers
2k views
How to trace malicious hackers?
What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker?
IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
2
votes
3answers
152 views
Are my credentials unsafe if I am already logged-in before connecting to a public network?
Let's say I am already logged-in to my Gmail or Yahoo account using my 3G then I switched to a public WIFI in an airport or cafe.
Is my username and password still vulnerable?
What others kinds of ...
1
vote
0answers
438 views
SIEM-AlienVault; Risk Metrics, Assets, and basics [closed]
Been trying for a week now to get AlienVault (referred to as AV hereon) running with little success.
I've gone through 2 installs so far.
First time messing with SIEM, though have very limited ...
4
votes
1answer
1k views
What's the risk of changing permissions of the Security Eventlog registry key to IT operations?
Background
Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code:
...
2
votes
2answers
2k views
Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?
On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity ...
4
votes
2answers
286 views
What features do you look for in an Enterprise Log Management solution?
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them.
What are your requirements for such a Event Log ...
-2
votes
3answers
328 views
Why bother with attack detection?
The question below goes from a wrong assumption that attacker is able to spoof IP when making HTTP connection. But attacker isn't able to spoof IP if he doesn't have direct access to connection ...
3
votes
2answers
462 views
failed login attempts analysis
Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same,
the login failure is at windows or unix or mac user authentication ...
4
votes
3answers
172 views
Are there a standard method(s) for me to give someone else read-only access to my data?
Are there a standard method(s) for me to give someone else read-only access to my data?
There are several situations where I may want to give a few people read-only access to some data, but I would ...
