Questions tagged [administration]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
88 views

Cyber Essentials at a small business (20 employees) that keeps all business data within SaaS

Background I've recently joined a rapidly growing small business (from 4 to 20 people in last 12 months) with a very DIY IT setup. It's fallen to me (I'm a developer so I just happen to be sitting ...
0
votes
0answers
40 views

Management Network Architecture

I've recently taken a job that has me more involved in network architecture than I ever have been, so please offer me some patience. I am standing up a network at a new office location. So far I have ...
0
votes
1answer
61 views

Is it true that frontend validation is generally redundant for minimalist contact forms on minimalist environments?

Say I have a continuously upgraded and well maintained LAMP environment with a website which its CMS is all-core and continuously upgraded as well and I have created a simple backend HTML contact form ...
2
votes
1answer
79 views

What can my device administrator see when I am connected to a private WiFi?

I use a device that has access to things like incognito mode. However, it warns me that the device administrator can see what I do even when in incognito. I know that this is true when connected to an ...
2
votes
1answer
215 views

What are the security risks to have admin rights for a user account on Windows 10?

I am considering the security risks to have a standard user added to the Administrators group on an enterprise Windows 10 machine that is dedicated to that user. This is related to security only, so ...
1
vote
3answers
4k views

Can schools track what I'm doing, even though I'm on my personal Gmail account?

My school can track my browsing when I'm at home and using the Google account they gave me, the laptop is my personal one. Is there a way that they could track what I do, even though I'm on my other ...
2
votes
2answers
906 views

Can my school computer see my files via USB?

I was issued a chromebook, as was everyone at my school, to use for work in class and in case school has to shut down again. We bring it home so it connects to my personal Wi-Fi when I'm at home. I ...
0
votes
1answer
59 views

server access to application owners

I am looking for the right practice to provide access to application owners. As of now they are part of system admins groups. whoever part of the group login tho the servers any time and do any stuff. ...
3
votes
2answers
91 views

Applying “principle of least privilege” when it comes to execs and owners of the company - should they automatically get all permissions if requested?

As an administrator of certain systems in a company I understand and adhere to the "principle of least privilege" -- which I'm assuming I don't need to repeat its definition here, so let's just say ...
0
votes
1answer
52 views

Do corporate systems need to be updated immediately after updates are available? [duplicate]

I lived under impression that timely updates were very important. Even a home user wouldn't like their computer to demand ransom for their data. However, the less home and the more corporate our ...
0
votes
0answers
26 views

Local Account ( with LAPS) vs Domain Joined Account ( member of local Administrator group )

I got a question. What would be preferred more secure option for managing computers. Using local admin accounts with LAPS, password changed every 24hrs Or Domain Joined account that is member of ...
2
votes
1answer
100 views

Is running Powershell always as administrator a good practice?

I work as software engineer in a company. The IT deparment has decided to forbid powershell execution from our computers as part of the actions they are implementing to avoid Emotet malware. As ...
-1
votes
1answer
252 views

How to run .exe on windows startup without having admin access? [closed]

I want to know how to bypass the requirement of an admin user in order to have a program run upon windows startup.
0
votes
0answers
34 views

Is it a good practice to implement admin pages in a mobile application?

So let's say there's a page on the website that shows the admin all the messages that came in from the users since he last logged in. And it's implemented on the mobile application, with checks in ...
2
votes
3answers
258 views

What are the techniques to know if VPS cloud hosting provider is accessing my data?

Immutable laws of security: https://fossbytes.com/10-immutable-laws-security-microsoft/ If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore. I understand ...
0
votes
0answers
52 views

What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?

During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
1
vote
0answers
54 views

Remote access to Windows Workstation with credentials, after Windows 10 - 1809

I am a newbie in terms of OS security and I started learning from Windows; in particular I downloaded Win10 virtual machine and I am simulating various attack / defense scenarios on it. I would like ...
1
vote
1answer
783 views

Securing Flask admin pages

We've been developing a Flask app for a customer and a part of the agreement was that "customer admins" would be allowed to access Flask admin page to manage users, roles and business entities. The ...
1
vote
0answers
282 views

How to prevent the ransomware to run with administrator privileges?

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the ...
1
vote
2answers
300 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
26
votes
7answers
6k views

How to prevent admins to access logs from their own activity?

The idea would be to prevent an attacker who has stolen a root/admin account or escalated to clear his own activities or even read the traces of what he is doing. Let's assume we are under Linux, we ...
0
votes
1answer
181 views

Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?

There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc. The only requirement for administrative access ...
3
votes
2answers
60 views

When is an email rejected?

Currently, I am working on a web application and wanted to let users send emails to others through a web form. So, they just should submit their email address and my web app would then send mails to ...
1
vote
1answer
98 views

Should I be concerned if my school district has a major shell exposed? [duplicate]

I'm a 7th grader. The school district I'm in likes to try to make it look like they are the most secure school in the world. I discovered a major flaw in their security system. This was a shell that ...
3
votes
1answer
122 views

How can I ensure higher levels of privacy when hosting others' emails?

I can set up my own email server, and quite happy with it, using standard open source components - postfix, roundcube, etc on top of HardenedBSD or OpenBSD. I'd like to offer the use of my email ...
1
vote
1answer
83 views

Is the hosting OS safe to sql injection hackers by hiding admin ID?

We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...
3
votes
1answer
156 views

Central console antivirus for Linux computers in LAN or equivalent solution

In our company, we need by policy AVs on every developers' Linux (Mint) computers. Right now we have ClamAV running on them, daily scheduled scans and every developer manually sends the report log to ...
2
votes
2answers
90 views

Using a login in automation

While working a contract for a company that needs data security, I found a python script that a previous person had made which used login details stored in plain-text locally. On a network of roughly ...
0
votes
1answer
71 views

Permission to a user in a subfolder inside a folder to which he does not have access [closed]

I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario: I have a folder called X where only a few groups have access, inside that ...
5
votes
1answer
356 views

Is it acceptable for security engineers to have admin access to production servers?

In my organization, our server infrastructure team has historically held all admin access to production servers. We're recently trying to strengthen our security posture, so we have hired several new ...
2
votes
2answers
96 views

Is it possible for a network administrator to disable interactive elements on a webpage? (such as text boxes)

As part of my degree, we're currently looking at a hypothetical scenario in which internet access is introduced to prison cells. As part of the information risk assessment, I was wondering if it is ...
0
votes
3answers
127 views

More than one admin required on site to login to a database/resources

What is the terminology used in computer security where you need at least two admins at the same time to login/access a database/resources? Maybe by each having part of the password or key. This used ...
39
votes
4answers
47k views

Microsoft email servers “require remote control of Android device security features”

Just tried to set up my student email address with the default email client on my Android device. The email servers used by the university are outlook.office365.com (incoming) and smtp.office365.com (...
1
vote
0answers
85 views

How are local admin accounts handled in a DFARS compliant environment?

In most IT departments that I've been apart of we've had local administrator accounts that we can use when the given machine, for some reason, doesn't have network access, or domain access. One of ...
6
votes
2answers
931 views

Securely granting local administrative permissions

I’ve been researching the best method of securely granting local administrative permissions but I’m really struggling to reconcile the security, operational, and cost implications. I’ve devised a few ...
1
vote
2answers
109 views

How (un)safe is it to protect an admin page with a simple query-string password? [duplicate]

I have a very simple admin web page that simply displays feedback messages left by users of my mobile app. The messages are sent from the app to a web server, and to view the messages one needs to ...
1
vote
1answer
3k views

How to properly implement pseudonymization

In my company we want to implement pseudonymization to fulfill some GDPR requirements. From what I understand, the purpose of pseudonymization is to prohibit easy access to all information about one ...
1
vote
1answer
343 views

How dangerous are reverse-shells to a network?

I'm working on a simple reverse-shell thingy in Python. It can accept and interpret commands on a shell spawned on the victim. Unfortunately it doesn't support features like ping, traceroute, nbtstat (...
1
vote
1answer
212 views

Give users a powershell script to run - Secure?

Is there a secure and practical way to give a group of users a powershell script to run on their laptops? The users all have active directory accounts, but their computers are not joined to any ...
0
votes
2answers
2k views

My admin password was changed!

Can someone hack my router and change my admin password for Linksys router but leave my wifi passwords the same. Tried logging in on 3 different browser and 2 different computers. I also tried using ...
-1
votes
1answer
175 views

shared key random number generator with obscuring admin panel

i'm trying to make another security layer above the 2FA layer for super admin panel/login what i have in mind so far is a shared key (shared seed) to generate random guids that is created by client-...
2
votes
1answer
111 views

How to justify a Vulnerability Research function at a company

From a business standpoint, how would you express the need for a vulnerability research team? In the end, would it be infeasible from a business standpoint unless said business chalked it up as a ...
1
vote
0answers
45 views

Objectively speaking, what is the expected standard to prepare for an interview as network admin? [closed]

I have an interview middle of next month for a position as network admin. As I understand things, clients are running Windows but some servers may be running Linux. What is the expected standard in ...
1
vote
2answers
1k views

Which information is revealed to a network-admin when using VPN?

When I am using a VPN in a foreign network e.g. at my workplace or in an open W-LAN of a coffee shop, is it possible for the network admin to bypass my protection from the VPN? How does it look like ...
11
votes
3answers
5k views

Can admin see my password when I enter it?

If the admin is a super user, nothing can prevent them from installing anything on my host, including keystroke logger. Are there any security mechanisms that can protect my account against that?
5
votes
6answers
439 views

What is a good data encryption strategy for a shared resource(text)?

I have a use case where I need to encrypt a piece of PII information in a database, which then can be decrypted and accessed by multiple user roles in an application (e.g the user it belongs to, ...
1
vote
1answer
54 views

Apple device management

Not sure if this has been answered but I cannot find anything via the search. The whole company (10 people) use Apple devices but aren't all in the same office. Are there any tools that I can use to ...
2
votes
1answer
145 views

Unauthorised access to admin area of a rails app, from the company's IP

As a company, we have a rails application with an administration panel, using active admin gem. If the user has the admin role, then a link to administration page appears. Yesterday, someone got into ...
3
votes
3answers
874 views

Admin Interface: Web vs Desktop

I am working to build a system that requires an interface to control existing data and add new ones. It's really nothing complex, just a few objects related to users, organisation etc. The problem is ...
5
votes
2answers
157 views

Isn't separating privileges less useful on a PC, as all my critical data is in my normal user account?

Separating privileges, i.e using a non-admin account and escalating only when needed, seems to be something everyone agrees on. I can roughly understand why it's important on every system : prevent an ...