Questions tagged [administration]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
14 views

Is my perception of improved security by restricting access to an MS365 tenant/associated apps on per-device basis misguided? Why?

Receiving guidance from a contractor that restricting unknown devices (regardless of MFA, location, etc.) to an Azure tenant does not improve security in any meaningful way, and just creates a ...
user avatar
1 vote
1 answer
91 views

Investigate who blocked local admin from running mmc

The local admin was recently blocked from running mmc.exe. UAC message says 'An administrator has blocked you from running this app.' I'm looking for details on how to investigate this. I'm not sure ...
user avatar
1 vote
2 answers
181 views

Can a ransomware attack succeed with no root privileges, but instead if it does have privileged user access?

If an attacker succeeds in getting the password of an IT support privileged account (that has Domain Control rights), can he successfully carry out the attack and do the lateral movement needed ...
user avatar
  • 33
0 votes
0 answers
101 views

How many emails and accounts an organization's administrator and developer should have?

Let's say there is a small organization called "Example" with the registered domain "example.com". There is a person, Bob, who has full control over the organization's GitHub ...
user avatar
1 vote
1 answer
136 views

Cyber Essentials at a small business (20 employees) that keeps all business data within SaaS

Background I've recently joined a rapidly growing small business (from 4 to 20 people in last 12 months) with a very DIY IT setup. It's fallen to me (I'm a developer so I just happen to be sitting ...
user avatar
  • 11
0 votes
1 answer
171 views

Is it true that frontend validation is generally redundant for minimalist contact forms on minimalist environments?

Say I have a continuously upgraded and well maintained LAMP environment with a website which its CMS is all-core and continuously upgraded as well and I have created a simple backend HTML contact form ...
user avatar
2 votes
1 answer
173 views

What can my device administrator see when I am connected to a private WiFi?

I use a device that has access to things like incognito mode. However, it warns me that the device administrator can see what I do even when in incognito. I know that this is true when connected to an ...
user avatar
3 votes
2 answers
480 views

What are the security risks to have admin rights for a user account on Windows 10?

I am considering the security risks to have a standard user added to the Administrators group on an enterprise Windows 10 machine that is dedicated to that user. This is related to security only, so ...
user avatar
  • 8,925
1 vote
3 answers
12k views

Can schools track what I'm doing, even though I'm on my personal Gmail account?

My school can track my browsing when I'm at home and using the Google account they gave me, the laptop is my personal one. Is there a way that they could track what I do, even though I'm on my other ...
user avatar
  • 11
2 votes
2 answers
2k views

Can my school computer see my files via USB?

I was issued a chromebook, as was everyone at my school, to use for work in class and in case school has to shut down again. We bring it home so it connects to my personal Wi-Fi when I'm at home. I ...
user avatar
  • 21
0 votes
1 answer
115 views

server access to application owners

I am looking for the right practice to provide access to application owners. As of now they are part of system admins groups. whoever part of the group login tho the servers any time and do any stuff. ...
user avatar
3 votes
2 answers
175 views

Applying "principle of least privilege" when it comes to execs and owners of the company - should they automatically get all permissions if requested?

As an administrator of certain systems in a company I understand and adhere to the "principle of least privilege" -- which I'm assuming I don't need to repeat its definition here, so let's just say ...
user avatar
0 votes
1 answer
90 views

Do corporate systems need to be updated immediately after updates are available? [duplicate]

I lived under impression that timely updates were very important. Even a home user wouldn't like their computer to demand ransom for their data. However, the less home and the more corporate our ...
user avatar
  • 5,587
0 votes
0 answers
73 views

Local Account ( with LAPS) vs Domain Joined Account ( member of local Administrator group )

I got a question. What would be preferred more secure option for managing computers. Using local admin accounts with LAPS, password changed every 24hrs Or Domain Joined account that is member of ...
user avatar
2 votes
1 answer
160 views

Is running Powershell always as administrator a good practice?

I work as software engineer in a company. The IT deparment has decided to forbid powershell execution from our computers as part of the actions they are implementing to avoid Emotet malware. As ...
user avatar
  • 131
-1 votes
1 answer
851 views

How to run .exe on windows startup without having admin access? [closed]

I want to know how to bypass the requirement of an admin user in order to have a program run upon windows startup.
user avatar
0 votes
0 answers
70 views

Is it a good practice to implement admin pages in a mobile application?

So let's say there's a page on the website that shows the admin all the messages that came in from the users since he last logged in. And it's implemented on the mobile application, with checks in ...
user avatar
  • 1
2 votes
3 answers
422 views

What are the techniques to know if VPS cloud hosting provider is accessing my data?

Immutable laws of security: https://fossbytes.com/10-immutable-laws-security-microsoft/ If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore. I understand ...
user avatar
0 votes
0 answers
97 views

What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?

During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
user avatar
  • 445
1 vote
0 answers
90 views

Remote access to Windows Workstation with credentials, after Windows 10 - 1809

I am a newbie in terms of OS security and I started learning from Windows; in particular I downloaded Win10 virtual machine and I am simulating various attack / defense scenarios on it. I would like ...
user avatar
1 vote
1 answer
887 views

Securing Flask admin pages

We've been developing a Flask app for a customer and a part of the agreement was that "customer admins" would be allowed to access Flask admin page to manage users, roles and business entities. The ...
user avatar
  • 1,505
1 vote
0 answers
349 views

How to prevent the ransomware to run with administrator privileges?

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the ...
user avatar
  • 111
1 vote
2 answers
513 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
user avatar
  • 11
26 votes
7 answers
7k views

How to prevent admins to access logs from their own activity?

The idea would be to prevent an attacker who has stolen a root/admin account or escalated to clear his own activities or even read the traces of what he is doing. Let's assume we are under Linux, we ...
user avatar
  • 585
0 votes
1 answer
235 views

Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?

There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc. The only requirement for administrative access ...
user avatar
3 votes
2 answers
101 views

When is an email rejected?

Currently, I am working on a web application and wanted to let users send emails to others through a web form. So, they just should submit their email address and my web app would then send mails to ...
user avatar
  • 759
1 vote
1 answer
144 views

Should I be concerned if my school district has a major shell exposed? [duplicate]

I'm a 7th grader. The school district I'm in likes to try to make it look like they are the most secure school in the world. I discovered a major flaw in their security system. This was a shell that ...
user avatar
3 votes
1 answer
170 views

How can I ensure higher levels of privacy when hosting others' emails?

I can set up my own email server, and quite happy with it, using standard open source components - postfix, roundcube, etc on top of HardenedBSD or OpenBSD. I'd like to offer the use of my email ...
user avatar
  • 1,664
1 vote
1 answer
123 views

Is the hosting OS safe to sql injection hackers by hiding admin ID?

We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...
user avatar
  • 1,051
3 votes
1 answer
199 views

Central console antivirus for Linux computers in LAN or equivalent solution

In our company, we need by policy AVs on every developers' Linux (Mint) computers. Right now we have ClamAV running on them, daily scheduled scans and every developer manually sends the report log to ...
user avatar
2 votes
2 answers
134 views

Using a login in automation

While working a contract for a company that needs data security, I found a python script that a previous person had made which used login details stored in plain-text locally. On a network of roughly ...
user avatar
0 votes
1 answer
109 views

Permission to a user in a subfolder inside a folder to which he does not have access [closed]

I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario: I have a folder called X where only a few groups have access, inside that ...
user avatar
  • 101
8 votes
2 answers
561 views

Is it acceptable for security engineers to have admin access to production servers?

In my organization, our server infrastructure team has historically held all admin access to production servers. We're recently trying to strengthen our security posture, so we have hired several new ...
user avatar
  • 1,434
2 votes
2 answers
141 views

Is it possible for a network administrator to disable interactive elements on a webpage? (such as text boxes)

As part of my degree, we're currently looking at a hypothetical scenario in which internet access is introduced to prison cells. As part of the information risk assessment, I was wondering if it is ...
user avatar
  • 21
0 votes
3 answers
163 views

More than one admin required on site to login to a database/resources

What is the terminology used in computer security where you need at least two admins at the same time to login/access a database/resources? Maybe by each having part of the password or key. This used ...
user avatar
  • 128
39 votes
4 answers
49k views

Microsoft email servers "require remote control of Android device security features"

Just tried to set up my student email address with the default email client on my Android device. The email servers used by the university are outlook.office365.com (incoming) and smtp.office365.com (...
user avatar
  • 1,639
1 vote
0 answers
126 views

How are local admin accounts handled in a DFARS compliant environment?

In most IT departments that I've been apart of we've had local administrator accounts that we can use when the given machine, for some reason, doesn't have network access, or domain access. One of ...
user avatar
6 votes
2 answers
1k views

Securely granting local administrative permissions

I’ve been researching the best method of securely granting local administrative permissions but I’m really struggling to reconcile the security, operational, and cost implications. I’ve devised a few ...
user avatar
1 vote
2 answers
166 views

How (un)safe is it to protect an admin page with a simple query-string password? [duplicate]

I have a very simple admin web page that simply displays feedback messages left by users of my mobile app. The messages are sent from the app to a web server, and to view the messages one needs to ...
user avatar
  • 213
1 vote
1 answer
3k views

How to properly implement pseudonymization

In my company we want to implement pseudonymization to fulfill some GDPR requirements. From what I understand, the purpose of pseudonymization is to prohibit easy access to all information about one ...
user avatar
  • 113
1 vote
1 answer
485 views

How dangerous are reverse-shells to a network?

I'm working on a simple reverse-shell thingy in Python. It can accept and interpret commands on a shell spawned on the victim. Unfortunately it doesn't support features like ping, traceroute, nbtstat (...
user avatar
1 vote
1 answer
266 views

Give users a powershell script to run - Secure?

Is there a secure and practical way to give a group of users a powershell script to run on their laptops? The users all have active directory accounts, but their computers are not joined to any ...
user avatar
0 votes
2 answers
2k views

My admin password was changed!

Can someone hack my router and change my admin password for Linksys router but leave my wifi passwords the same. Tried logging in on 3 different browser and 2 different computers. I also tried using ...
user avatar
-1 votes
1 answer
248 views

shared key random number generator with obscuring admin panel

i'm trying to make another security layer above the 2FA layer for super admin panel/login what i have in mind so far is a shared key (shared seed) to generate random guids that is created by client-...
user avatar
  • 23
2 votes
1 answer
149 views

How to justify a Vulnerability Research function at a company

From a business standpoint, how would you express the need for a vulnerability research team? In the end, would it be infeasible from a business standpoint unless said business chalked it up as a ...
user avatar
1 vote
0 answers
74 views

Objectively speaking, what is the expected standard to prepare for an interview as network admin? [closed]

I have an interview middle of next month for a position as network admin. As I understand things, clients are running Windows but some servers may be running Linux. What is the expected standard in ...
user avatar
  • 111
1 vote
2 answers
1k views

Which information is revealed to a network-admin when using VPN?

When I am using a VPN in a foreign network e.g. at my workplace or in an open W-LAN of a coffee shop, is it possible for the network admin to bypass my protection from the VPN? How does it look like ...
user avatar
  • 229
11 votes
3 answers
5k views

Can admin see my password when I enter it?

If the admin is a super user, nothing can prevent them from installing anything on my host, including keystroke logger. Are there any security mechanisms that can protect my account against that?
user avatar
5 votes
6 answers
483 views

What is a good data encryption strategy for a shared resource(text)?

I have a use case where I need to encrypt a piece of PII information in a database, which then can be decrypted and accessed by multiple user roles in an application (e.g the user it belongs to, ...
user avatar
  • 221
1 vote
1 answer
83 views

Apple device management

Not sure if this has been answered but I cannot find anything via the search. The whole company (10 people) use Apple devices but aren't all in the same office. Are there any tools that I can use to ...
user avatar
  • 445