Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [audit]

For questions about the assessment of hardware, software, systems, people, processes, projects, etc, that are somehow related to the security of an organization or product. Often these are related to a certification the organization or product holds, or looking for tools or processes for performing an audit.

0
votes
0answers
25 views

SQL injection in Go [on hold]

Is this code vulnerable to SQL injection (Golang) ? i tried to use the database/sql lib with the "?" properly. If yes how to improve my code ? func (dab *DbAuthenticationBackend) Authenticate(ctx ...
1
vote
0answers
65 views

127.0.0.1 host header injection

I would like to know if this configuration is vulnerable to host header injection. I think it isn't, because it's listening on localhost, but I'm not sure. <VirtualHost 127.0.0.1:[% port %]> ...
0
votes
0answers
58 views

Security Audit on AWS - question on findings

Just wondering about an assessment I'm doing regarding a client's AWS environment. I'm new to AWS to I'm having to learn a lot on the go. I used ScoutSuite and got some findings, specifically: EC2: *...
-1
votes
1answer
63 views

Perform privilege escalation using local root exploit

I am trying to perform a privilege escalation on a Debian 8 system running on kernel version 3.16.0-4-amd64. Since the system I am performing an audit on is not up to date I was thinking a local root ...
0
votes
0answers
17 views

Windows event log - Security - Audit failure

Every one hour or so I have this event in my Event viewer -> Windows logs -> Security log. I understand the consent.exe is Windows' UAC control, what i wan't to know is why and what is trying ...
0
votes
0answers
15 views

CIS-CAT tool on german windows

I'm using the cis cat tool (https://learn.cisecurity.org/cis-cat-landing-page) to audit the windows policies on my windows machine (german localisation). The cis cat tools reports a lot of false ...
1
vote
0answers
30 views

Where to find security information about Common Lisp, SBCL and some others Lisp libraries?

I am currently developing some web tools (http server, peer to peer, ...) in Common Lisp, and I deal with datas such as ledger transactions for cryptocurrency systems or payments via Braintree/Paypal. ...
2
votes
0answers
34 views

What tools and techniques do we have at disposal to manually search for rootkits?

I use tools from sysinternals for various tasks (ex. process monitor), but I'm not sure if these programs can be used to manual rootkit detection since rootkit processes can be hiden. Are there any ...
0
votes
0answers
5 views

How to log failure to start/stop a service? [migrated]

I want to track whether a normal user attempted to run a service. The command for starting/stopping service is given as below: service filebeat start I wrote an auditd rule like below: -w /usr/sbin/...
1
vote
1answer
50 views

How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?

Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session. ...
2
votes
0answers
45 views

Can ISO 27001 auditors audit their own work?

It may seem that the question in the title is stupid, but it is not. There is a known case of deletion of "Auditors shall not audit their own work" rule in 2015 version of ISO 9001 and the remaining ...
0
votes
2answers
56 views

Detecting Spoofed InDesign File Creation Date

I apologize for turning here with a question, my research both searching here and on Google has only turned up useless information. I believe that someone has sent me files that have had their file ...
0
votes
0answers
36 views

Should Session-Timeout events be logged

I am working on Audit logs for an ERP project and searching for all kind of events to be logged. In this project, session, timeouts on inactivity. I was wondering if logout by session-timeout should ...
0
votes
0answers
28 views

Was ISO 17799:2005 the first ISO standard to introduce risk management?

I'm doing research into ISO 17799:2005, more specifically its policies related to risk management and its involvement on risk management in the wider IT sector, but I can't find out the answer to: ...
0
votes
1answer
59 views

Security auditing - disabling IP forwarding and ICMP packets redirects

I've recently started working as a security auditor and my mentor gave me some homework to write an Ubuntu security audit script so that I'll get to learn to use batch scripting and understand ...
0
votes
1answer
40 views

What would be the best way to evaulate the database management systems? [closed]

I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
0
votes
0answers
17 views

What security controls that needs to be evaluated for DB2 Mainframe, SQL Server, PostgreSQL, and Guardium application?

I am an Information Security analyst, evaluating the above mentioned applications and looking for a high risk items the requires deeper testing. I would really appreciate guides, books, or anything ...
1
vote
0answers
38 views

UDF Client, Socket Binding and Tags Hack - Need Help [closed]

Background For a long time now, I've been working to remove a persistent, if not permanent, malware presence on my computers and phones. Every attempt at removal has been unsuccessful to date, by me ...
0
votes
1answer
86 views

What information should I provide to third party pen testers - (black box penetration)

I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have ...
1
vote
0answers
37 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
0
votes
0answers
9 views

Resolving XML External Entity Defect in message audit service?

A corporate code analysis tool identified a security vulnerability in a web service that my team maintains. It identified an XXE (XML External Entity) vulnerability in this service and referenced the ...
0
votes
1answer
77 views

Which type of authentication is not prone to man-in-the-middle attacks?

I am preparing for the CISA exam and come across material saying "challenge response-based authentication is prone to session hijacking or man-in-the-middle attacks". But the material doesn't mention ...
1
vote
1answer
47 views

Is it possible to detect if a trojan or program sends information by sniffing the network of a VM

Explaining better, I was consulting on how I can ensure that the programs of an operating system does not perform any suspicious activity with my information, and I have been told that electronic ...
0
votes
1answer
52 views

Security Incident File Change Timestamp

How can I obtain all timestamps of all files ( starting"/") on a Linux system in order to verify if a file was changed within a breach?
0
votes
2answers
49 views

What are the main security concerns for Enteprise Software running on internal networks?

What do Enterprise Security teams test when they buy third party products, before they sign the check? Presumably they have a standard despite the main protection being the firewall and IDS. Is ...
1
vote
2answers
151 views

Security code review recommendations [closed]

I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
1
vote
1answer
102 views

Open Source Security Audit

I recently forked a project on GitHub that had been abandoned, cleaned up a lot of the code and started to make improvements to it. As it's a forked project I'd like to find out what the best way to ...
2
votes
1answer
234 views

How to use CIS Benchmarks without being a CIS member

I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be ...
2
votes
4answers
333 views

Is it safer to trust software/company that has been hacked in the past?

Which is better, when you have choices between 2 competing products: First one, which has never been publicly reported about being hacked or having security holes or Second one, which has had bad ...
2
votes
4answers
113 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
1
vote
0answers
60 views

How to determine who turned off security logging on my windows server?

We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't ...
0
votes
1answer
44 views

Python hazmat danger

Is hazmat considered to be secure? Here is a quote from their docs: This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing ...
1
vote
1answer
111 views

auditd-like software for Windows?

I need to know how to log users and admins activity on Windows, like auditd does on Linux. After searching, the only thing I found was this Audit account log-on events policy option for Windows 7. ...
2
votes
2answers
98 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
2
votes
1answer
93 views

SOC 2 audit for small business (6 employees) with no IT department [closed]

One of our clients is demanding that we complete a SOC 2 Type II audit. There is no way we will meet the standard, and, considering we only handle publicly available data, it is ridiculous that they ...
0
votes
1answer
56 views

What is the best way to know current attack for a server machine? [closed]

I'm hosting centos 7 servers which are exposed to the risk of malicious attacks. I have to protect the machines from the attacks. What is the best way to know how to protect attacks from system ...
1
vote
0answers
23 views

Certification courses from a novice to professional [closed]

I would like to know the list of certification courses that I can start as a beginner and become proficient in the field of network security and from which website or institution can I take the ...
1
vote
1answer
76 views

PCI Compliance Scan & Globalscape EFT Web App Cookies Not Marked Secure

I have a situation where we are performing external PCI compliance scans against our Globalscape EFT server. The scan is reporting: HTTP (443/tcp) - Web Application Cookies Not Marked Secure Per our ...
1
vote
1answer
62 views

Auditd logging related to SELinux? [closed]

Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?
2
votes
2answers
234 views

Is it a good idea to upload your gnupg files to github?

I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?
0
votes
1answer
1k views

Kali Linux and Cell Phone Security

Are there any built in tools/programs in Kali Linux that specifically target cell phones? Furthermore, do any of these tools/programs work remotely without sending a listener to the target?
1
vote
0answers
23 views

Hadoop Transparent Data Encryption: protection from interference of EDEK, EZK and DEK

I am preparing a response to a security auditor. They have presented a generic question about the protection from substitution of KEK and DEK in a "normal" encryption mechanism. What protection ...
1
vote
1answer
265 views

Authy reviewed? [closed]

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on ...
1
vote
1answer
119 views

Is IP address whitelisting useful if the IP address is not “secret”?

I'm working on an application that will have access to API keys supplied by our users. The application makes API calls on behalf of our users. The API we're using allows users to whitelist IP ...
3
votes
3answers
643 views

How to assure my customer that my software is malware proof?

We are delivering an application which our customers can use on their network cluster. Now, is there any way that we can certify that the software is malware proof and is not going to spread malware ...
117
votes
19answers
29k views

Is it common to allow local admin access for developers in organizations?

I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people). Recently due to security concerns our IT and ...
1
vote
0answers
119 views

Is there any modern scalable way to do system call monitoring?

I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
1
vote
0answers
20 views

OpenVPN Invalid Logins lock with PAM

We are getting dinged on a federal audit because OpenVPN does not appear to support invalid login restrictions (i.e., only 3 before the account is locked). Has anyone else experienced this? We are ...
6
votes
1answer
169 views

Is this file sharing approach safe?

I am currently developing a piece of software where files need to be uploaded and then shared with other people that are not on the platform itself. Here is my approach on encryption: A user has a ...
0
votes
0answers
104 views

ANSSI/ PASSI standard

I am looking for more information on the ANSSI/ PASSI standard, which I am guessing (based on limited information on google) is a French cybersecurity or data and privacy protection regulation or ...