Questions tagged [audit]

For questions about the assessment of hardware, software, systems, people, processes, projects, etc, that are somehow related to the security of an organization or product. Often these are related to a certification the organization or product holds, or looking for tools or processes for performing an audit.

0
votes
0answers
40 views

Mysql CIS benchmarks with Maria DB database [closed]

I have a server with mariaDB DataBase installed, can I use the MYSQL CIS benchmarks to harden mariaDB DataBase ?
-4
votes
3answers
123 views

Is code obfuscation common in FOSS?

I am a learner of FOSS licensing, security and privacy. I ask this question because one of the arguments persuading users to use or switch to FOSS is the fact that since the code is open, an expert ...
1
vote
1answer
78 views

Are there technical framework for IT sec audit just like there are management frameworks?

TL;DR Are there technical frameworks (processes with checklists ruled by international standards like COBIT, ISO 27000) for IT security analysis/auditing ? Hello, Let's say you're a software ...
1
vote
0answers
75 views

Instance metadata on IBM Cloud

Is there any way to get instance metadata on IMB Cloud (a.k.a Bluemix) K8s cluster, from a compromised pod? Something like doing curl to http://metadata.google.internal/computeMetadata/v1/instance/......
0
votes
4answers
157 views

Can revealing Intranet address become a security threat?

If I publicly list my company's intranet and extranet website addresses, is it a risk?
0
votes
1answer
54 views

Securing Home Network using 3rd Party Firmware / Access Points

I've been having some trouble on my home network and thought that having a router as an AP would help fix these attacks. At first it did, but now it seems the attackers have gotten through. For all I ...
1
vote
1answer
170 views

How could the Chinese Communications Authority find a backdoor on my website?

I host a legacy HTTP website on my own hardware in China. It was attacked due to the Struts file upload flaw last month. But yesterday, Communications Authority in my province alarmed me, there is ...
3
votes
1answer
114 views

Are there any known vulnerabilities in libre office password protection for *.odt files?

I was looking for a source to determine the safety of password protection in libre office. The thread at ask.libreoffice.org suggest its save to use. However the thread is rather old and it is hosted ...
0
votes
2answers
128 views

Is it possible to bypass this Xss Filter?

Everyone, I was creating this XSS filter for my node plugin and I want to know is it possible to bypass this? function xSSFilter(str) { return str .replace(/&/g, '&') ...
3
votes
1answer
63 views

Verifying Security of a Custom Network Protocol

I’ve designed a custom network protocol using high-level LibSodium primitives for authentication and encryption. The purpose of the protocol is for a game, and the security is to ensure only paid ...
1
vote
0answers
93 views

127.0.0.1 host header injection

I would like to know if this configuration is vulnerable to host header injection. I think it isn't, because it's listening on localhost, but I'm not sure. <VirtualHost 127.0.0.1:[% port %]> ...
2
votes
1answer
238 views

Security Audit on AWS - question on findings

Just wondering about an assessment I'm doing regarding a client's AWS environment. I'm new to AWS to I'm having to learn a lot on the go. I used ScoutSuite and got some findings, specifically: EC2: *...
0
votes
1answer
106 views

Windows event log - Security - Audit failure

Every one hour or so I have this event in my Event viewer -> Windows logs -> Security log. I understand the consent.exe is Windows' UAC control, what i wan't to know is why and what is trying ...
0
votes
0answers
31 views

CIS-CAT tool on german windows

I'm using the cis cat tool (https://learn.cisecurity.org/cis-cat-landing-page) to audit the windows policies on my windows machine (german localisation). The cis cat tools reports a lot of false ...
1
vote
0answers
47 views

Where to find security information about Common Lisp, SBCL and some others Lisp libraries?

I am currently developing some web tools (http server, peer to peer, ...) in Common Lisp, and I deal with datas such as ledger transactions for cryptocurrency systems or payments via Braintree/Paypal. ...
3
votes
1answer
68 views

What tools and techniques do we have at disposal to manually search for rootkits?

I use tools from sysinternals for various tasks (ex. process monitor), but I'm not sure if these programs can be used to manual rootkit detection since rootkit processes can be hiden. Are there any ...
1
vote
1answer
53 views

How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?

Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session. ...
2
votes
0answers
55 views

Can ISO 27001 auditors audit their own work?

It may seem that the question in the title is stupid, but it is not. There is a known case of deletion of "Auditors shall not audit their own work" rule in 2015 version of ISO 9001 and the remaining ...
0
votes
2answers
61 views

Detecting Spoofed InDesign File Creation Date

I apologize for turning here with a question, my research both searching here and on Google has only turned up useless information. I believe that someone has sent me files that have had their file ...
0
votes
1answer
67 views

Should Session-Timeout events be logged

I am working on Audit logs for an ERP project and searching for all kind of events to be logged. In this project, session, timeouts on inactivity. I was wondering if logout by session-timeout should ...
0
votes
0answers
28 views

Was ISO 17799:2005 the first ISO standard to introduce risk management?

I'm doing research into ISO 17799:2005, more specifically its policies related to risk management and its involvement on risk management in the wider IT sector, but I can't find out the answer to: ...
0
votes
1answer
82 views

Security auditing - disabling IP forwarding and ICMP packets redirects

I've recently started working as a security auditor and my mentor gave me some homework to write an Ubuntu security audit script so that I'll get to learn to use batch scripting and understand ...
0
votes
1answer
40 views

What would be the best way to evaulate the database management systems? [closed]

I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
0
votes
0answers
21 views

What security controls that needs to be evaluated for DB2 Mainframe, SQL Server, PostgreSQL, and Guardium application?

I am an Information Security analyst, evaluating the above mentioned applications and looking for a high risk items the requires deeper testing. I would really appreciate guides, books, or anything ...
1
vote
0answers
40 views

UDF Client, Socket Binding and Tags Hack - Need Help [closed]

Background For a long time now, I've been working to remove a persistent, if not permanent, malware presence on my computers and phones. Every attempt at removal has been unsuccessful to date, by me ...
1
vote
1answer
96 views

What information should I provide to third party pen testers - (black box penetration)

I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have ...
1
vote
0answers
41 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
0
votes
0answers
21 views

Resolving XML External Entity Defect in message audit service?

A corporate code analysis tool identified a security vulnerability in a web service that my team maintains. It identified an XXE (XML External Entity) vulnerability in this service and referenced the ...
0
votes
1answer
83 views

Which type of authentication is not prone to man-in-the-middle attacks?

I am preparing for the CISA exam and come across material saying "challenge response-based authentication is prone to session hijacking or man-in-the-middle attacks". But the material doesn't mention ...
1
vote
1answer
49 views

Is it possible to detect if a trojan or program sends information by sniffing the network of a VM

Explaining better, I was consulting on how I can ensure that the programs of an operating system does not perform any suspicious activity with my information, and I have been told that electronic ...
0
votes
1answer
53 views

Security Incident File Change Timestamp

How can I obtain all timestamps of all files ( starting"/") on a Linux system in order to verify if a file was changed within a breach?
0
votes
2answers
50 views

What are the main security concerns for Enteprise Software running on internal networks?

What do Enterprise Security teams test when they buy third party products, before they sign the check? Presumably they have a standard despite the main protection being the firewall and IDS. Is ...
1
vote
2answers
196 views

Security code review recommendations [closed]

I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
1
vote
1answer
103 views

Open Source Security Audit

I recently forked a project on GitHub that had been abandoned, cleaned up a lot of the code and started to make improvements to it. As it's a forked project I'd like to find out what the best way to ...
2
votes
1answer
556 views

How to use CIS Benchmarks without being a CIS member

I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be ...
2
votes
4answers
338 views

Is it safer to trust software/company that has been hacked in the past?

Which is better, when you have choices between 2 competing products: First one, which has never been publicly reported about being hacked or having security holes or Second one, which has had bad ...
2
votes
4answers
114 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
1
vote
0answers
63 views

How to determine who turned off security logging on my windows server?

We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't ...
0
votes
1answer
49 views

Python hazmat danger

Is hazmat considered to be secure? Here is a quote from their docs: This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing ...
1
vote
1answer
200 views

auditd-like software for Windows?

I need to know how to log users and admins activity on Windows, like auditd does on Linux. After searching, the only thing I found was this Audit account log-on events policy option for Windows 7. ...
2
votes
2answers
102 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
2
votes
1answer
138 views

SOC 2 audit for small business (6 employees) with no IT department [closed]

One of our clients is demanding that we complete a SOC 2 Type II audit. There is no way we will meet the standard, and, considering we only handle publicly available data, it is ridiculous that they ...
0
votes
1answer
56 views

What is the best way to know current attack for a server machine? [closed]

I'm hosting centos 7 servers which are exposed to the risk of malicious attacks. I have to protect the machines from the attacks. What is the best way to know how to protect attacks from system ...
1
vote
0answers
29 views

Certification courses from a novice to professional [closed]

I would like to know the list of certification courses that I can start as a beginner and become proficient in the field of network security and from which website or institution can I take the ...
1
vote
1answer
96 views

PCI Compliance Scan & Globalscape EFT Web App Cookies Not Marked Secure

I have a situation where we are performing external PCI compliance scans against our Globalscape EFT server. The scan is reporting: HTTP (443/tcp) - Web Application Cookies Not Marked Secure Per our ...
1
vote
1answer
100 views

Auditd logging related to SELinux? [closed]

Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?
2
votes
2answers
258 views

Is it a good idea to upload your gnupg files to github?

I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?
0
votes
1answer
2k views

Kali Linux and Cell Phone Security

Are there any built in tools/programs in Kali Linux that specifically target cell phones? Furthermore, do any of these tools/programs work remotely without sending a listener to the target?
1
vote
0answers
26 views

Hadoop Transparent Data Encryption: protection from interference of EDEK, EZK and DEK

I am preparing a response to a security auditor. They have presented a generic question about the protection from substitution of KEK and DEK in a "normal" encryption mechanism. What protection ...
2
votes
1answer
432 views

Authy reviewed? [closed]

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on ...