Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [audit]

For questions about the assessment of hardware, software, systems, people, processes, projects, etc, that are somehow related to the security of an organization or product. Often these are related to a certification the organization or product holds, or looking for tools or processes for performing an audit.

0
votes
1answer
81 views

How could the Chinese Communications Authority find a backdoor on my website?

I host a legacy HTTP website on my own hardware in China. It was attacked due to the Struts file upload flaw last month. But yesterday, Communications Authority in my province alarmed me, there is ...
0
votes
0answers
14 views

Windows registry subkey creation not generating logs (Windows event ID 4657) [migrated]

I am experiencing an issue where I am trying to audit a specific registry key via Windows Event ID 4657. TL; DR: I have tried to setup auditing on a registry key when a new subkey is created under it,...
0
votes
0answers
24 views

Assistance with an interview assignment for my Techincal Writing Class [closed]

I have an assignment to interview someone who works in the field I'm studying for my major. I'm planning on a BAS in IT Security so if anyone here doesn't mind answering 10 quick questions i would ...
0
votes
0answers
39 views

How to disconnect established connections [closed]

I have an established connection 13.89.187.212 & 13.89.217.116 that is listed as a hacker on the ipabuse website. I type in 192.168.0.1 on several different browsers; some of them start acting ...
3
votes
1answer
100 views

Are there any known vulnerabilities in libre office password protection for *.odt files?

I was looking for a source to determine the safety of password protection in libre office. The thread at ask.libreoffice.org suggest its save to use. However the thread is rather old and it is hosted ...
0
votes
1answer
77 views

Is it possible to bypass this Xss Filter?

Everyone, I was creating this XSS filter for my node plugin and I want to know is it possible to bypass this? function xSSFilter(str) { return str .replace(/&/g, '&') ...
3
votes
1answer
56 views

Verifying Security of a Custom Network Protocol

I’ve designed a custom network protocol using high-level LibSodium primitives for authentication and encryption. The purpose of the protocol is for a game, and the security is to ensure only paid ...
1
vote
0answers
72 views

127.0.0.1 host header injection

I would like to know if this configuration is vulnerable to host header injection. I think it isn't, because it's listening on localhost, but I'm not sure. <VirtualHost 127.0.0.1:[% port %]> ...
2
votes
1answer
152 views

Security Audit on AWS - question on findings

Just wondering about an assessment I'm doing regarding a client's AWS environment. I'm new to AWS to I'm having to learn a lot on the go. I used ScoutSuite and got some findings, specifically: EC2: *...
0
votes
1answer
57 views

Windows event log - Security - Audit failure

Every one hour or so I have this event in my Event viewer -> Windows logs -> Security log. I understand the consent.exe is Windows' UAC control, what i wan't to know is why and what is trying ...
0
votes
0answers
18 views

CIS-CAT tool on german windows

I'm using the cis cat tool (https://learn.cisecurity.org/cis-cat-landing-page) to audit the windows policies on my windows machine (german localisation). The cis cat tools reports a lot of false ...
1
vote
0answers
37 views

Where to find security information about Common Lisp, SBCL and some others Lisp libraries?

I am currently developing some web tools (http server, peer to peer, ...) in Common Lisp, and I deal with datas such as ledger transactions for cryptocurrency systems or payments via Braintree/Paypal. ...
2
votes
0answers
34 views

What tools and techniques do we have at disposal to manually search for rootkits?

I use tools from sysinternals for various tasks (ex. process monitor), but I'm not sure if these programs can be used to manual rootkit detection since rootkit processes can be hiden. Are there any ...
1
vote
1answer
52 views

How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?

Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session. ...
2
votes
0answers
49 views

Can ISO 27001 auditors audit their own work?

It may seem that the question in the title is stupid, but it is not. There is a known case of deletion of "Auditors shall not audit their own work" rule in 2015 version of ISO 9001 and the remaining ...
0
votes
2answers
59 views

Detecting Spoofed InDesign File Creation Date

I apologize for turning here with a question, my research both searching here and on Google has only turned up useless information. I believe that someone has sent me files that have had their file ...
0
votes
0answers
37 views

Should Session-Timeout events be logged

I am working on Audit logs for an ERP project and searching for all kind of events to be logged. In this project, session, timeouts on inactivity. I was wondering if logout by session-timeout should ...
0
votes
0answers
28 views

Was ISO 17799:2005 the first ISO standard to introduce risk management?

I'm doing research into ISO 17799:2005, more specifically its policies related to risk management and its involvement on risk management in the wider IT sector, but I can't find out the answer to: ...
0
votes
1answer
61 views

Security auditing - disabling IP forwarding and ICMP packets redirects

I've recently started working as a security auditor and my mentor gave me some homework to write an Ubuntu security audit script so that I'll get to learn to use batch scripting and understand ...
0
votes
1answer
40 views

What would be the best way to evaulate the database management systems? [closed]

I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
0
votes
0answers
18 views

What security controls that needs to be evaluated for DB2 Mainframe, SQL Server, PostgreSQL, and Guardium application?

I am an Information Security analyst, evaluating the above mentioned applications and looking for a high risk items the requires deeper testing. I would really appreciate guides, books, or anything ...
1
vote
0answers
39 views

UDF Client, Socket Binding and Tags Hack - Need Help [closed]

Background For a long time now, I've been working to remove a persistent, if not permanent, malware presence on my computers and phones. Every attempt at removal has been unsuccessful to date, by me ...
1
vote
1answer
91 views

What information should I provide to third party pen testers - (black box penetration)

I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have ...
1
vote
0answers
37 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
0
votes
0answers
15 views

Resolving XML External Entity Defect in message audit service?

A corporate code analysis tool identified a security vulnerability in a web service that my team maintains. It identified an XXE (XML External Entity) vulnerability in this service and referenced the ...
0
votes
1answer
80 views

Which type of authentication is not prone to man-in-the-middle attacks?

I am preparing for the CISA exam and come across material saying "challenge response-based authentication is prone to session hijacking or man-in-the-middle attacks". But the material doesn't mention ...
1
vote
1answer
47 views

Is it possible to detect if a trojan or program sends information by sniffing the network of a VM

Explaining better, I was consulting on how I can ensure that the programs of an operating system does not perform any suspicious activity with my information, and I have been told that electronic ...
0
votes
1answer
53 views

Security Incident File Change Timestamp

How can I obtain all timestamps of all files ( starting"/") on a Linux system in order to verify if a file was changed within a breach?
0
votes
2answers
49 views

What are the main security concerns for Enteprise Software running on internal networks?

What do Enterprise Security teams test when they buy third party products, before they sign the check? Presumably they have a standard despite the main protection being the firewall and IDS. Is ...
1
vote
2answers
159 views

Security code review recommendations [closed]

I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
1
vote
1answer
102 views

Open Source Security Audit

I recently forked a project on GitHub that had been abandoned, cleaned up a lot of the code and started to make improvements to it. As it's a forked project I'd like to find out what the best way to ...
2
votes
1answer
293 views

How to use CIS Benchmarks without being a CIS member

I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be ...
2
votes
4answers
334 views

Is it safer to trust software/company that has been hacked in the past?

Which is better, when you have choices between 2 competing products: First one, which has never been publicly reported about being hacked or having security holes or Second one, which has had bad ...
2
votes
4answers
113 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
1
vote
0answers
60 views

How to determine who turned off security logging on my windows server?

We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't ...
0
votes
1answer
46 views

Python hazmat danger

Is hazmat considered to be secure? Here is a quote from their docs: This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing ...
1
vote
1answer
139 views

auditd-like software for Windows?

I need to know how to log users and admins activity on Windows, like auditd does on Linux. After searching, the only thing I found was this Audit account log-on events policy option for Windows 7. ...
2
votes
2answers
100 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
2
votes
1answer
105 views

SOC 2 audit for small business (6 employees) with no IT department [closed]

One of our clients is demanding that we complete a SOC 2 Type II audit. There is no way we will meet the standard, and, considering we only handle publicly available data, it is ridiculous that they ...
0
votes
1answer
56 views

What is the best way to know current attack for a server machine? [closed]

I'm hosting centos 7 servers which are exposed to the risk of malicious attacks. I have to protect the machines from the attacks. What is the best way to know how to protect attacks from system ...
1
vote
0answers
23 views

Certification courses from a novice to professional [closed]

I would like to know the list of certification courses that I can start as a beginner and become proficient in the field of network security and from which website or institution can I take the ...
1
vote
1answer
80 views

PCI Compliance Scan & Globalscape EFT Web App Cookies Not Marked Secure

I have a situation where we are performing external PCI compliance scans against our Globalscape EFT server. The scan is reporting: HTTP (443/tcp) - Web Application Cookies Not Marked Secure Per our ...
1
vote
1answer
73 views

Auditd logging related to SELinux? [closed]

Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?
2
votes
2answers
249 views

Is it a good idea to upload your gnupg files to github?

I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?
0
votes
1answer
1k views

Kali Linux and Cell Phone Security

Are there any built in tools/programs in Kali Linux that specifically target cell phones? Furthermore, do any of these tools/programs work remotely without sending a listener to the target?
1
vote
0answers
25 views

Hadoop Transparent Data Encryption: protection from interference of EDEK, EZK and DEK

I am preparing a response to a security auditor. They have presented a generic question about the protection from substitution of KEK and DEK in a "normal" encryption mechanism. What protection ...
2
votes
1answer
306 views

Authy reviewed? [closed]

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on ...
1
vote
1answer
132 views

Is IP address whitelisting useful if the IP address is not “secret”?

I'm working on an application that will have access to API keys supplied by our users. The application makes API calls on behalf of our users. The API we're using allows users to whitelist IP ...
3
votes
3answers
646 views

How to assure my customer that my software is malware proof?

We are delivering an application which our customers can use on their network cluster. Now, is there any way that we can certify that the software is malware proof and is not going to spread malware ...
117
votes
19answers
30k views

Is it common to allow local desktop admin access and rights for developers in organizations?

I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people). Recently due to security concerns our IT and ...