Questions tagged [audit]

For questions about the assessment of software, hardware, systems, people, processes, procedures, projects, etc, that are somehow related to the security of an organization or product. Often these are related to a certification the organization or product holds, or looking for tools or processes for performing an audit.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

Lynis Audit Difference Between Found Known Binary and Just Found

When I run a Lynis audit of my Xubuntu system, under System Tools, binary scan, most of the binaries are returned as Found known binary: package (pkg category) - /path/to/binary But under /usr/bin ...
0
votes
1answer
71 views

Third party consultants background checks, NDA signing etc for SOC-2

We are a SOC-2 compliant company. We used to have all full time employees till now, hence we could do our due diligence on all the hired employees e.g. Background checks, reference checks, getting NDA ...
1
vote
1answer
85 views

How could I know if a website is fingerprinting you via WebGL?

I would like to know if a website is fingerprinting me via WebGL, first of all, knowing if the site is doing it Knowing when they send the request to my browser Knowing what value I am reporting to ...
0
votes
0answers
21 views

With SOC2 Type 1&2 compliance, how long should a session timeout be? [duplicate]

Is there a strict limit on this with SOC2 Type 1&2 compliance? Do these differ on web and mobile?
0
votes
1answer
45 views

Do the organisational policies need to have ownership to ensure accountability?

Policies are the high-level statement from Senior Management. It's a philosophy for the management to be guided by, and management has the direction to plan, build, run and monitor the activities to ...
0
votes
1answer
94 views

What alternative standard for ISO 27001 can be used in Australia?

I am looking for alternatives, that are less strict and less time consuming, than ISO 27001. Australia is in the Commonwealth, so maybe Cyber Essentials Plus could work, but I do not know if that ...
1
vote
1answer
107 views

What information should I collect when a user performs an action on a website? [closed]

In the development of an organization's web system (containing sensitive information) with credentials, where the actions carried out must be monitored, what information should I keep when each action ...
0
votes
1answer
59 views

Synology logs SMB "Read" event false positives

We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
1
vote
0answers
41 views

AuditD and SysCall alerts

Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work? When an application gets executed do all the ...
1
vote
0answers
113 views

What to do when you simply cannot trust anyone anymore? [closed]

I need a CSS crusher and it must be made in PHP or be a very trusted stand-alone CLI application. The only thing I can find is this: https://github.com/peteboere/css-crush It's not been updated in ...
0
votes
0answers
28 views

intranet users: auditing of credentials vs online vaults (example: lastpass, 1password)

Scenario: a medium company (750 users). Some of them use online services to store their credentials (office email and other web applications), like lastpass and 1password. The IT wants to audit the ...
0
votes
1answer
109 views

How to start pentesting/reverse engineering/cracking a software on Linux? (Docker based) [closed]

TL:DR; What are good learning resources for security testing a software which runs with Docker on Ubuntu. I am in junior position at this company, and they figured it would be good if I just test ...
1
vote
1answer
54 views

PCI scope for a Direct-Post e-commerce site (SAQ A-EP)

An e-commerce site uses the Direct-Post method (see page 14 PCI e-commerce security). Is the server for the e-commerce application and network it resides on in scope for PCI? There are questions in ...
1
vote
1answer
207 views

auditd rules for both 64-bit (b64) and 32-bit (b32) architectures

I'm looking at the OpenSCAP Security Guide for CentOS 7: https://static.open-scap.org/ssg-guides/ssg-centos7-guide-index.html Under "Record File Deletion Events by User" (as an example), it ...
7
votes
2answers
214 views

Do people even exist who actually vet all the updates to their open source software?

A year or so ago, I set up this system which, whenever Composer (that's PHP's packet/library update manager) fetched new updates to my few (but critically required) third-party libraries, created a ...
-1
votes
2answers
90 views

Election security is considered one of the most difficult problems in computer security [closed]

Not just electronic voting, but in election security general. I think it part is because there are many components to it, and it has many components that could be compromised. What are some of the top ...
0
votes
2answers
94 views

Is there any such thing as an independent code vetting project which works for free to vet open source projects?

I'm sure I'm not the only one who is scared to death to blindly trust random strangers with all my data. Which is the case in practice if, for example, I'm to use this library right now, which I'm ...
1
vote
1answer
75 views

Is it possible to ensure detection and logging of all attempts to copy data out of a system?

I am cross-posting this question from Serverfault, because I am in doubt where it fits best. Say I have a server set up for processing sensitive data. The few authorised users of the system are ...
0
votes
2answers
77 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
2
votes
1answer
61 views

Need help collating resources for an information/cyber security audit document for an MSP

I am currently serving out an internship with a small MSP (4 employees, 50-100 clients with between a couple and 100 employees). My main project is to work on a information/cyber security audit ...
0
votes
1answer
65 views

Monitoring User (developer) interaction

I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system. To expand a bit more about this, we have several systems that run ...
3
votes
1answer
160 views

Getting numerous HEAD requests by Java user agents to resources that require authentication to view within a web application. Should I block them?

I have recently started using Cloudflare's firewall in front of a web application. This app has a limited user base of selected applicants and they must log in to view anything. There is no public ...
0
votes
1answer
103 views

Difference between Web App Pentesting and Web App Security Audit

I'm having a hard time drawing the line between Web App pentesting vs a Web App Security Audit. For instance, OWASP Testing Guide could be used for both of those cases. Let's say the pentester and ...
0
votes
1answer
75 views

IT security audit : is threat modelling key to reproducible success of just following a methodology (ex : ethical hacking)

To sum up the methodology of ethical hacking, what you do is : Information gathering (gets the IP, domains, etc...) Fingerprint the IP (what OS, what services are running, etc...) Vulnerability ...
0
votes
1answer
67 views

How can Linux service installation page create an attack surface?

Based on one of the lectures of Planning, Auditing and Maintaining Enterprise system course by Greg Williams (Department of computer science university of Colorado): Let's say they were installing ...
3
votes
1answer
543 views

Is it insecure to expose private bucket names through signed URL?

AWS provides signed url to objects in bucket.On backend we can connect with AWS and create such signed urls and send to front-endJust discussing this one use case where we use that signed url to make ...
0
votes
0answers
108 views

Is attribute-based encryption safe for production use?

I'm very interested in attribute-based encryption (ABE). I see various working examples online, and I want to know, has it been verified as production-ready? What does it mean to have a security audit,...
0
votes
0answers
92 views

How to Ask for More Transparency from Companies Handling Our Personal Data

A company's asked me to submit a scan of my passport claiming KYC (Know Your Customer) and AML (Anti-money Laundering) purposes. In times of daily data breaches, what can we ask for a company to be ...
1
vote
0answers
47 views

saving entire Windows event log for auditing & preserve digital evidence

As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down. ...
86
votes
6answers
20k views

How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me? [duplicate]

I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
0
votes
3answers
181 views

Providing password review results to auditors

The IT Security department is getting audited and the auditor had approached our IT Security team and requests to see results of the password review process, which compares existing database of ...
3
votes
1answer
149 views

When a closed-source company hires somebody to audit their code, is the auditor forced to do it in the company's office?

Let's say that ACME, Inc. is making closed-source software. It's closed for a reason (they don't want it leaving their building other than in compiled form). Now, they are hiring some company/person ...
4
votes
3answers
264 views

How do we cross-verify if the device is doing exactly what it is supposed to do?

How do we know any device is doing what it is supposed to do? For example, Android is an open-source OS (ignore google libraries for now) and they do claim that all passwords will only be stored on ...
0
votes
0answers
64 views

Sony Access Log (Playstation Network) does not exists

Yesterday my wife receive some emails from Sony confirming her purchases on Playstation Network. The only problem is: she was with my side watching Netflix on the smart Tv. The purchased items is a ...
0
votes
1answer
353 views

Rails File.open(#{Rails.root}) is vulnerable to LFI?

I am performing White Box testing on Rails application with static code analyzing tools like brakeman, I came across an instance where the developer is loading images using file.open. file = File....
1
vote
1answer
113 views

Security requirement for an R&D team [closed]

I have an R&D team that has been recently set up. I have been asked to help out with the cyber-security requirements for the department. They require access to anything and everything available on ...
0
votes
1answer
94 views

Is it ok and useful to keep a security audit report after completing an audit?

I recently ran a couple of security audits for some friends, and was thinking about doing some more. Before I do though, I wanted to know whether I should keep the audit reports and, if so, how? I ...
1
vote
1answer
204 views

Security and the Definition of Ready and Done [closed]

Currently I am in a project where I have to test REST APIs among other things. In another question of mine I also discussed the topics Definition of Ready and Definition of Done regarding security. ...
0
votes
2answers
153 views

Rest API Security Guideline. Developer Rules? [closed]

In my current project I am also setting up the area of security testing. So far there was no way to use security within the REST API development. Beside the known approach, e.g. using static software ...
0
votes
1answer
120 views

Security test within a staging environment. Is SOAPUI sufficient as a test tool?

Currently I am working on a project in which I am supposed to define the following aspects as a test manager: Conception of a penetration test for a test staging environment Planning security ...
1
vote
1answer
65 views

Tool to prepare report of security auditing [closed]

I was doing dorking on my friend's website to make sure there is no leak of information that is not meant to be. I found domains and sub-domains in search results. Is their a tool which can help me ...
0
votes
2answers
635 views

How to perform a security test/review/penetration testing of Ethernet ports?

I have been engaged by a client who wants its Ethernet ports checked to determine whether port security is functioning effectively. What can be the approach or steps to do check Ethernet port ...
1
vote
1answer
158 views

Does SOC1/SOC2 mandate installing non Security related patches

I am looking at our patch management control for SQL Server databases and until now the process only requires us to install security patches. Microsoft releases cumulative updates every month and it ...
2
votes
2answers
99 views

How can I log access and usage of a MySQL database?

I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current ...
-4
votes
3answers
147 views

Is code obfuscation common in FOSS?

I am a learner of FOSS licensing, security and privacy. I ask this question because one of the arguments persuading users to use or switch to FOSS is the fact that since the code is open, an expert ...
1
vote
1answer
108 views

Are there technical framework for IT sec audit just like there are management frameworks?

TL;DR Are there technical frameworks (processes with checklists ruled by international standards like COBIT, ISO 27000) for IT security analysis/auditing ? Hello, Let's say you're a software ...
1
vote
0answers
182 views

Instance metadata on IBM Cloud [closed]

Is there any way to get instance metadata on IMB Cloud (a.k.a Bluemix) K8s cluster, from a compromised pod? Something like doing curl to http://metadata.google.internal/computeMetadata/v1/instance/......
0
votes
4answers
195 views

Can revealing Intranet address become a security threat?

If I publicly list my company's intranet and extranet website addresses, is it a risk?
0
votes
2answers
100 views

Securing Home Network using 3rd Party Firmware / Access Points

I've been having some trouble on my home network and thought that having a router as an AP would help fix these attacks. At first it did, but now it seems the attackers have gotten through. For all I ...
1
vote
1answer
183 views

How could the Chinese Communications Authority find a backdoor on my website?

I host a legacy HTTP website on my own hardware in China. It was attacked due to the Struts file upload flaw last month. But yesterday, Communications Authority in my province alarmed me, there is ...

1
2 3 4 5
9