Questions tagged [administration]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
46 views

Do corporate systems need to be updated immediately after updates are available? [duplicate]

I lived under impression that timely updates were very important. Even a home user wouldn't like their computer to demand ransom for their data. However, the less home and the more corporate our ...
0
votes
0answers
20 views

Local Account ( with LAPS) vs Domain Joined Account ( member of local Administrator group )

I got a question. What would be preferred more secure option for managing computers. Using local admin accounts with LAPS, password changed every 24hrs Or Domain Joined account that is member of ...
2
votes
1answer
74 views

Is running Powershell always as administrator a good practice?

I work as software engineer in a company. The IT deparment has decided to forbid powershell execution from our computers as part of the actions they are implementing to avoid Emotet malware. As ...
-1
votes
1answer
95 views

How to run .exe on windows startup without having admin access? [closed]

I want to know how to bypass the requirement of an admin user in order to have a program run upon windows startup.
0
votes
0answers
34 views

Is it a good practice to implement admin pages in a mobile application?

So let's say there's a page on the website that shows the admin all the messages that came in from the users since he last logged in. And it's implemented on the mobile application, with checks in ...
0
votes
0answers
31 views

On public cloud, admin account requiring authorization from multiple people?

Is there any public cloud where it is possible to set up protection on highly privileged admin accounts such that usage of such an account requires approval by a second admin? The idea is that we don'...
2
votes
3answers
154 views

What are the techniques to know if VPS cloud hosting provider is accessing my data?

Immutable laws of security: https://fossbytes.com/10-immutable-laws-security-microsoft/ If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore. I understand ...
0
votes
0answers
37 views

Software build processes - Dependencies without admin privileges

we have the following problem and I would like to hear your opinions for this case: Currently several users are working with domain accounts which are in the local admin group (Yes, shame...) You ...
0
votes
0answers
48 views

What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?

During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
1
vote
0answers
53 views

Remote access to Windows Workstation with credentials, after Windows 10 - 1809

I am a newbie in terms of OS security and I started learning from Windows; in particular I downloaded Win10 virtual machine and I am simulating various attack / defense scenarios on it. I would like ...
1
vote
1answer
629 views

Securing Flask admin pages

We've been developing a Flask app for a customer and a part of the agreement was that "customer admins" would be allowed to access Flask admin page to manage users, roles and business entities. The ...
1
vote
0answers
201 views

How to prevent the ransomware to run with administrator privileges?

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the ...
1
vote
2answers
145 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
26
votes
7answers
6k views

How to prevent admins to access logs from their own activity?

The idea would be to prevent an attacker who has stolen a root/admin account or escalated to clear his own activities or even read the traces of what he is doing. Let's assume we are under Linux, we ...
0
votes
1answer
148 views

Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?

There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc. The only requirement for administrative access ...
3
votes
2answers
54 views

When is an email rejected?

Currently, I am working on a web application and wanted to let users send emails to others through a web form. So, they just should submit their email address and my web app would then send mails to ...
1
vote
1answer
97 views

Should I be concerned if my school district has a major shell exposed? [duplicate]

I'm a 7th grader. The school district I'm in likes to try to make it look like they are the most secure school in the world. I discovered a major flaw in their security system. This was a shell that ...
3
votes
1answer
102 views

How can I ensure higher levels of privacy when hosting others' emails?

I can set up my own email server, and quite happy with it, using standard open source components - postfix, roundcube, etc on top of HardenedBSD or OpenBSD. I'd like to offer the use of my email ...
1
vote
1answer
77 views

Is the hosting OS safe to sql injection hackers by hiding admin ID?

We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...
3
votes
1answer
142 views

Central console antivirus for Linux computers in LAN or equivalent solution

In our company, we need by policy AVs on every developers' Linux (Mint) computers. Right now we have ClamAV running on them, daily scheduled scans and every developer manually sends the report log to ...
2
votes
2answers
87 views

Using a login in automation

While working a contract for a company that needs data security, I found a python script that a previous person had made which used login details stored in plain-text locally. On a network of roughly ...
0
votes
1answer
63 views

Permission to a user in a subfolder inside a folder to which he does not have access [closed]

I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario: I have a folder called X where only a few groups have access, inside that ...
5
votes
1answer
254 views

Is it acceptable for security engineers to have admin access to production servers?

In my organization, our server infrastructure team has historically held all admin access to production servers. We're recently trying to strengthen our security posture, so we have hired several new ...
2
votes
2answers
94 views

Is it possible for a network administrator to disable interactive elements on a webpage? (such as text boxes)

As part of my degree, we're currently looking at a hypothetical scenario in which internet access is introduced to prison cells. As part of the information risk assessment, I was wondering if it is ...
0
votes
3answers
120 views

More than one admin required on site to login to a database/resources

What is the terminology used in computer security where you need at least two admins at the same time to login/access a database/resources? Maybe by each having part of the password or key. This used ...
34
votes
4answers
38k views

Microsoft email servers “require remote control of Android device security features”

Just tried to set up my student email address with the default email client on my Android device. The email servers used by the university are outlook.office365.com (incoming) and smtp.office365.com (...
1
vote
0answers
71 views

How are local admin accounts handled in a DFARS compliant environment?

In most IT departments that I've been apart of we've had local administrator accounts that we can use when the given machine, for some reason, doesn't have network access, or domain access. One of ...
6
votes
2answers
775 views

Securely granting local administrative permissions

I’ve been researching the best method of securely granting local administrative permissions but I’m really struggling to reconcile the security, operational, and cost implications. I’ve devised a few ...
1
vote
2answers
88 views

How (un)safe is it to protect an admin page with a simple query-string password? [duplicate]

I have a very simple admin web page that simply displays feedback messages left by users of my mobile app. The messages are sent from the app to a web server, and to view the messages one needs to ...
1
vote
1answer
2k views

How to properly implement pseudonymization

In my company we want to implement pseudonymization to fulfill some GDPR requirements. From what I understand, the purpose of pseudonymization is to prohibit easy access to all information about one ...
1
vote
1answer
253 views

How dangerous are reverse-shells to a network?

I'm working on a simple reverse-shell thingy in Python. It can accept and interpret commands on a shell spawned on the victim. Unfortunately it doesn't support features like ping, traceroute, nbtstat (...
1
vote
1answer
190 views

Give users a powershell script to run - Secure?

Is there a secure and practical way to give a group of users a powershell script to run on their laptops? The users all have active directory accounts, but their computers are not joined to any ...
0
votes
2answers
1k views

My admin password was changed!

Can someone hack my router and change my admin password for Linksys router but leave my wifi passwords the same. Tried logging in on 3 different browser and 2 different computers. I also tried using ...
-1
votes
1answer
145 views

shared key random number generator with obscuring admin panel

i'm trying to make another security layer above the 2FA layer for super admin panel/login what i have in mind so far is a shared key (shared seed) to generate random guids that is created by client-...
1
vote
1answer
97 views

How to justify a Vulnerability Research function at a company

From a business standpoint, how would you express the need for a vulnerability research team? In the end, would it be infeasible from a business standpoint unless said business chalked it up as a ...
1
vote
0answers
45 views

Objectively speaking, what is the expected standard to prepare for an interview as network admin? [closed]

I have an interview middle of next month for a position as network admin. As I understand things, clients are running Windows but some servers may be running Linux. What is the expected standard in ...
1
vote
2answers
733 views

Which information is revealed to a network-admin when using VPN?

When I am using a VPN in a foreign network e.g. at my workplace or in an open W-LAN of a coffee shop, is it possible for the network admin to bypass my protection from the VPN? How does it look like ...
11
votes
3answers
4k views

Can admin see my password when I enter it?

If the admin is a super user, nothing can prevent them from installing anything on my host, including keystroke logger. Are there any security mechanisms that can protect my account against that?
5
votes
6answers
431 views

What is a good data encryption strategy for a shared resource(text)?

I have a use case where I need to encrypt a piece of PII information in a database, which then can be decrypted and accessed by multiple user roles in an application (e.g the user it belongs to, ...
1
vote
1answer
50 views

Apple device management

Not sure if this has been answered but I cannot find anything via the search. The whole company (10 people) use Apple devices but aren't all in the same office. Are there any tools that I can use to ...
2
votes
1answer
140 views

Unauthorised access to admin area of a rails app, from the company's IP

As a company, we have a rails application with an administration panel, using active admin gem. If the user has the admin role, then a link to administration page appears. Yesterday, someone got into ...
3
votes
3answers
731 views

Admin Interface: Web vs Desktop

I am working to build a system that requires an interface to control existing data and add new ones. It's really nothing complex, just a few objects related to users, organisation etc. The problem is ...
5
votes
2answers
142 views

Isn't separating privileges less useful on a PC, as all my critical data is in my normal user account?

Separating privileges, i.e using a non-admin account and escalating only when needed, seems to be something everyone agrees on. I can roughly understand why it's important on every system : prevent an ...
2
votes
2answers
123 views

How to deal with administration tools such as ipscanners and PSTools?

In my company (And many others around the world) there is a wide usage by tech teams of tools such as ipscanners, psexec, pskill and other tools. How do you deal or control the usage of such tools in ...
0
votes
1answer
81 views

Securing Macbooks in an Enterprise Environment [closed]

I have been looking online at different forums/websites but was not able to find a direct answer. Does a checklist/process or software exist to secure Macbook computers in a enterprise environment( ...
2
votes
1answer
182 views

Administrative recovery control mentions antivirus - error?

I am reading through Version 7 of the CISSP study guide and stumbled on a possible error. It mentions - in the administrative controls section - that Recovery is a subset/alternate version of ...
0
votes
1answer
44 views

What patterns or practices exist to protect users from site admins deleting the user's information?

Here's my situation: Say you run a service online that stores information that users of the service would want to keep for a long time. This information could be notes, files, etc. but it is ...
2
votes
1answer
128 views

VPN Authentication and Network Administrators

Is it possible for a network admin (or attacker) to monitor traffic sent to a VPN server during authentication and end up being able to decrypt the data as if they were the legitimate user? I don't ...
1
vote
1answer
60 views

Network Scans Find Absent Device

Using Nessus (an uncredentialed full scan) and Nmap (essentially a full port scan), I am finding a phantom device. This device is supposed to be a well-out-of-commission device, but is returning a ...
0
votes
1answer
52 views

Create mod page for an anonymous website

I developed a website. There is no login section in the website. I didn't want to force people to sign up. Now I have a problem. There are a few .php pages that only I should access. How can I do that?...