Questions tagged [administration]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
42 views

Windows security introduction [closed]

I am studying "OS security" in my university and Windows 10 security is part of this course. I was using MacOS and UNIX-like systems for a long time and I almost zero Windows (including all aspects). ...
0
votes
0answers
31 views

Is it a good practice to implement admin pages in a mobile application?

So let's say there's a page on the website that shows the admin all the messages that came in from the users since he last logged in. And it's implemented on the mobile application, with checks in ...
0
votes
0answers
30 views

On public cloud, admin account requiring authorization from multiple people?

Is there any public cloud where it is possible to set up protection on highly privileged admin accounts such that usage of such an account requires approval by a second admin? The idea is that we don'...
2
votes
3answers
135 views

What are the techniques to know if VPS cloud hosting provider is accessing my data?

Immutable laws of security: https://fossbytes.com/10-immutable-laws-security-microsoft/ If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore. I understand ...
0
votes
0answers
35 views

Software build processes - Dependencies without admin privileges

we have the following problem and I would like to hear your opinions for this case: Currently several users are working with domain accounts which are in the local admin group (Yes, shame...) You ...
0
votes
0answers
48 views

What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?

During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
1
vote
0answers
49 views

Remote access to Windows Workstation with credentials, after Windows 10 - 1809

I am a newbie in terms of OS security and I started learning from Windows; in particular I downloaded Win10 virtual machine and I am simulating various attack / defense scenarios on it. I would like ...
1
vote
1answer
488 views

Securing Flask admin pages

We've been developing a Flask app for a customer and a part of the agreement was that "customer admins" would be allowed to access Flask admin page to manage users, roles and business entities. The ...
1
vote
0answers
152 views

How to prevent the ransomware to run with administrator privileges?

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the ...
1
vote
2answers
141 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
26
votes
7answers
6k views

How to prevent admins to access logs from their own activity?

The idea would be to prevent an attacker who has stolen a root/admin account or escalated to clear his own activities or even read the traces of what he is doing. Let's assume we are under Linux, we ...
0
votes
1answer
134 views

Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?

There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc. The only requirement for administrative access ...
3
votes
2answers
52 views

When is an email rejected?

Currently, I am working on a web application and wanted to let users send emails to others through a web form. So, they just should submit their email address and my web app would then send mails to ...
1
vote
1answer
96 views

Should I be concerned if my school district has a major shell exposed? [duplicate]

I'm a 7th grader. The school district I'm in likes to try to make it look like they are the most secure school in the world. I discovered a major flaw in their security system. This was a shell that ...
3
votes
1answer
95 views

How can I ensure higher levels of privacy when hosting others' emails?

I can set up my own email server, and quite happy with it, using standard open source components - postfix, roundcube, etc on top of HardenedBSD or OpenBSD. I'd like to offer the use of my email ...
1
vote
1answer
71 views

Is the hosting OS safe to sql injection hackers by hiding admin ID?

We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...
3
votes
1answer
131 views

Central console antivirus for Linux computers in LAN or equivalent solution

In our company, we need by policy AVs on every developers' Linux (Mint) computers. Right now we have ClamAV running on them, daily scheduled scans and every developer manually sends the report log to ...
2
votes
2answers
85 views

Using a login in automation

While working a contract for a company that needs data security, I found a python script that a previous person had made which used login details stored in plain-text locally. On a network of roughly ...
0
votes
1answer
61 views

Permission to a user in a subfolder inside a folder to which he does not have access [closed]

I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario: I have a folder called X where only a few groups have access, inside that ...
5
votes
1answer
197 views

Is it acceptable for security engineers to have admin access to production servers?

In my organization, our server infrastructure team has historically held all admin access to production servers. We're recently trying to strengthen our security posture, so we have hired several new ...
2
votes
2answers
92 views

Is it possible for a network administrator to disable interactive elements on a webpage? (such as text boxes)

As part of my degree, we're currently looking at a hypothetical scenario in which internet access is introduced to prison cells. As part of the information risk assessment, I was wondering if it is ...
0
votes
3answers
117 views

More than one admin required on site to login to a database/resources

What is the terminology used in computer security where you need at least two admins at the same time to login/access a database/resources? Maybe by each having part of the password or key. This used ...
31
votes
4answers
32k views

Microsoft email servers “require remote control of Android device security features”

Just tried to set up my student email address with the default email client on my Android device. The email servers used by the university are outlook.office365.com (incoming) and smtp.office365.com (...
1
vote
0answers
62 views

How are local admin accounts handled in a DFARS compliant environment?

In most IT departments that I've been apart of we've had local administrator accounts that we can use when the given machine, for some reason, doesn't have network access, or domain access. One of ...
6
votes
2answers
676 views

Securely granting local administrative permissions

I’ve been researching the best method of securely granting local administrative permissions but I’m really struggling to reconcile the security, operational, and cost implications. I’ve devised a few ...
1
vote
2answers
86 views

How (un)safe is it to protect an admin page with a simple query-string password? [duplicate]

I have a very simple admin web page that simply displays feedback messages left by users of my mobile app. The messages are sent from the app to a web server, and to view the messages one needs to ...
1
vote
1answer
2k views

How to properly implement pseudonymization

In my company we want to implement pseudonymization to fulfill some GDPR requirements. From what I understand, the purpose of pseudonymization is to prohibit easy access to all information about one ...
1
vote
1answer
207 views

How dangerous are reverse-shells to a network?

I'm working on a simple reverse-shell thingy in Python. It can accept and interpret commands on a shell spawned on the victim. Unfortunately it doesn't support features like ping, traceroute, nbtstat (...
1
vote
1answer
180 views

Give users a powershell script to run - Secure?

Is there a secure and practical way to give a group of users a powershell script to run on their laptops? The users all have active directory accounts, but their computers are not joined to any ...
0
votes
2answers
860 views

My admin password was changed!

Can someone hack my router and change my admin password for Linksys router but leave my wifi passwords the same. Tried logging in on 3 different browser and 2 different computers. I also tried using ...
-1
votes
1answer
136 views

shared key random number generator with obscuring admin panel

i'm trying to make another security layer above the 2FA layer for super admin panel/login what i have in mind so far is a shared key (shared seed) to generate random guids that is created by client-...
1
vote
1answer
87 views

How to justify a Vulnerability Research function at a company

From a business standpoint, how would you express the need for a vulnerability research team? In the end, would it be infeasible from a business standpoint unless said business chalked it up as a ...
1
vote
0answers
44 views

Objectively speaking, what is the expected standard to prepare for an interview as network admin? [closed]

I have an interview middle of next month for a position as network admin. As I understand things, clients are running Windows but some servers may be running Linux. What is the expected standard in ...
1
vote
2answers
522 views

Which information is revealed to a network-admin when using VPN?

When I am using a VPN in a foreign network e.g. at my workplace or in an open W-LAN of a coffee shop, is it possible for the network admin to bypass my protection from the VPN? How does it look like ...
11
votes
3answers
4k views

Can admin see my password when I enter it?

If the admin is a super user, nothing can prevent them from installing anything on my host, including keystroke logger. Are there any security mechanisms that can protect my account against that?
5
votes
6answers
428 views

What is a good data encryption strategy for a shared resource(text)?

I have a use case where I need to encrypt a piece of PII information in a database, which then can be decrypted and accessed by multiple user roles in an application (e.g the user it belongs to, ...
1
vote
1answer
49 views

Apple device management

Not sure if this has been answered but I cannot find anything via the search. The whole company (10 people) use Apple devices but aren't all in the same office. Are there any tools that I can use to ...
2
votes
1answer
136 views

Unauthorised access to admin area of a rails app, from the company's IP

As a company, we have a rails application with an administration panel, using active admin gem. If the user has the admin role, then a link to administration page appears. Yesterday, someone got into ...
3
votes
3answers
689 views

Admin Interface: Web vs Desktop

I am working to build a system that requires an interface to control existing data and add new ones. It's really nothing complex, just a few objects related to users, organisation etc. The problem is ...
5
votes
2answers
139 views

Isn't separating privileges less useful on a PC, as all my critical data is in my normal user account?

Separating privileges, i.e using a non-admin account and escalating only when needed, seems to be something everyone agrees on. I can roughly understand why it's important on every system : prevent an ...
2
votes
2answers
120 views

How to deal with administration tools such as ipscanners and PSTools?

In my company (And many others around the world) there is a wide usage by tech teams of tools such as ipscanners, psexec, pskill and other tools. How do you deal or control the usage of such tools in ...
0
votes
1answer
80 views

Securing Macbooks in an Enterprise Environment [closed]

I have been looking online at different forums/websites but was not able to find a direct answer. Does a checklist/process or software exist to secure Macbook computers in a enterprise environment( ...
2
votes
1answer
169 views

Administrative recovery control mentions antivirus - error?

I am reading through Version 7 of the CISSP study guide and stumbled on a possible error. It mentions - in the administrative controls section - that Recovery is a subset/alternate version of ...
0
votes
1answer
43 views

What patterns or practices exist to protect users from site admins deleting the user's information?

Here's my situation: Say you run a service online that stores information that users of the service would want to keep for a long time. This information could be notes, files, etc. but it is ...
2
votes
1answer
118 views

VPN Authentication and Network Administrators

Is it possible for a network admin (or attacker) to monitor traffic sent to a VPN server during authentication and end up being able to decrypt the data as if they were the legitimate user? I don't ...
1
vote
1answer
58 views

Network Scans Find Absent Device

Using Nessus (an uncredentialed full scan) and Nmap (essentially a full port scan), I am finding a phantom device. This device is supposed to be a well-out-of-commission device, but is returning a ...
0
votes
1answer
51 views

Create mod page for an anonymous website

I developed a website. There is no login section in the website. I didn't want to force people to sign up. Now I have a problem. There are a few .php pages that only I should access. How can I do that?...
4
votes
1answer
115 views

How does one typically monitor their privileged admins encrypted SSH & RDP sessions?

From a compliance (& perhaps just for pure due-diligence) standpoint, what do IT departments typically deploy to keep an eye on their privileged administrator's remote access sessions? Also what'...
1
vote
1answer
144 views

Authentication on client server

I have following requirements for system: My admins authenticate on client servers Over http Central authorization server My solution is based on O-Auth: user is redirected to authentication ...
5
votes
1answer
126 views

How can I objectively evaluate trust in a person? (Systems Admin, or other)

When recruiting for positions that require a level of integrity and trust, I'm looking for objective ways of accessing that, either positively or negatively. Is there any any guidance one should use ...