Skip to main content

Questions tagged [audit]

For questions about the assessment of software, hardware, systems, people, processes, procedures, projects, etc, that are somehow related to the security of an organization or product. Often these are related to a certification the organization or product holds, or looking for tools or processes for performing an audit.

Filter by
Sorted by
Tagged with
1 vote
0 answers
36 views

Log REST API calls in the most auditable way

I am working on a data processing task in an enterprise environment with Python3 installed on a client-side Windows Jump server. The data, which I need to download regularly from a third-party ...
gale44's user avatar
  • 11
0 votes
1 answer
107 views

Do I need to implement additional security measures for my self-hosted container web app?

Could you please suggest if I need to do anything else to ensure that my server is secure against the most common attacks? Currently it seems fine to me, but I would highly appreciate if someone with ...
dooshnila's user avatar
1 vote
1 answer
82 views

Execution profile for web server

I would like to know if there is a way to run an app to exhaustion in terms of all possible outcomes that it can provide. What do I mean by that: Let's assume that someone has an (Apache) HTTP Server. ...
und3rd06012's user avatar
0 votes
0 answers
25 views

Auditd and Auditbeat compatibility when using Sigma

I'm looking to integrate Sigma rules into my SOC ecosystem, and am bumping into issues with using Sigma rules. Specifically, auditd includes a "type" field which tags logs with some category,...
crystalrage's user avatar
0 votes
0 answers
20 views

Sigma "keywords" rules and Auditbeat

I've recently begun using Auditbeat for capturing and streaming audit logs from my Linux machine. I browsed the main rules repository, and noticed that many rules rely on the keywords feature of Sigma ...
crystalrage's user avatar
0 votes
1 answer
91 views

ISO 27001: do we need audit access to the code of the core application

We want to be 27001 certified and our company is based on one core application that is hosted in our cloud infrastructure but provided by a vendor. Is there a situation where an auditor needs access ...
Ritchie1962's user avatar
-1 votes
2 answers
216 views

Laptop Repair vs. Evil Maid

Suppose you need a laptop repair, so you bring it to A big box store where you have some sort of coverage (who will have the computer for 2-3 weeks) A small chain of repair shops a small independent ...
SurferTaco's user avatar
0 votes
0 answers
73 views

How can we verify the security of a device? [duplicate]

I've recently been experiencing a situation as follows: How can I understand the IO of an unknown device? Say, for example, I am gifted a bluetooth speaker. How can I understand its potential for ...
R S's user avatar
  • 101
0 votes
0 answers
91 views

Security frontend side

Hi i´m a frontend developer and next week we will have a security audit i need to be sure that frontend side is secure and dont have vulnerabilities, so my question is, ¿What would you recommend or ...
David Medina's user avatar
-1 votes
2 answers
187 views

Which standard can be used to seed security checklist for web application?

I am trying to create a security checklist for developers/testers of web applications to make sure that the web app is compliant with all the security guidelines. When looking at the different ...
ethicalhacker's user avatar
0 votes
0 answers
315 views

XSS Payload That Can Bypass Special Character Check

I developed the following C# algorithm to prevent XSS attacks: private bool Is_There_XSS_Payload(string arg) { Regex regex = new Regex(@"^[a-zA-Z0-9]+$"); bool result = ...
KosD's user avatar
  • 1
1 vote
1 answer
107 views

remediation for security related issues

I have a report by foresiet for a company's website. There's a bunch of files in the output. One example in App Misconfiguration : 344 x.x.x.x my-domain.io Weak SSH cipher supported! Medium Open Found ...
anjanesh's user avatar
  • 113
1 vote
0 answers
255 views

How did I get hacked? [closed]

As usual, I ordered a CentOS 7 virtual machine from my hoster. Installed a firewalld and docker on it. In docker, through docker-compose, I launched a web application that hangs on the standard port ...
RoyalGoose's user avatar
  • 1,045
1 vote
1 answer
196 views

User Access to Quarantined Emails

Are there any industry recommendations with regards to allowing users access to quarantined emails in Office 365? Should users be notified of quarantined emails. Should they be allowed to request the ...
CJamesEd's user avatar
1 vote
0 answers
108 views

How to find out what Microsoft 365 Defender is monitoring?

I am currently analyzing our security landscape with the help of the MITRE ATT&CK Framework. Most techniques have ways to "Mitigate" and to "Detect" it, and one of the most ...
Unbuckle's user avatar
3 votes
1 answer
375 views

Which of the following Linys auditing suggestions are worthwhile?

I'm currently securing a Linode VPS that will host a WordPress store and two Python web applications. Security-wise, I've run the most "basic" steps, such as hardening SSH access (i.e. ...
LeperAffinity666's user avatar
0 votes
1 answer
143 views

Verifying closed-source services' security [duplicate]

I tried to find a resource about how one verifies a service's security and their claims when they are not open source. Like 1Password, they describe many good approaches that they are using to secure ...
Okoba's user avatar
  • 17
0 votes
0 answers
81 views

Prevention of User Tampering the API by Serverless clients which are in sync with the real world client

As we all know, never trust the client, when they send data to your server. However what if you prevent data manipulation by completely restructuring the architecture to something like the following: ...
mrtechtroid's user avatar
1 vote
2 answers
2k views

Security Implications from Base64 Image

I copy / pasted a data:image/png;Base64 image from a Google search into a Google Slide, before realizing it was a BASE64 image. Is there any possibility that this contains malicious code, or any way ...
Questionstoask's user avatar
0 votes
1 answer
99 views

Questions on user context and auditing for background job execution for SaaS application

I have some questions related with user context and auditing for background job execution for SaaS application. Let's say an admin user scheduled a background job through UI. When the job start ...
user1024888's user avatar
0 votes
0 answers
71 views

System audit of hardened device regarding certificate handling

I am tasked with auditing the default configuration (system configuration, default applications...) that is set for some computers before they are given to users. Though I have never seen it anywhere, ...
mido's user avatar
  • 1
0 votes
0 answers
110 views

Is Reading Windows Reserved Filenames Through a URL Valid for OS Enumeration?

I'm aware that writing a file with a reserved name such as CON.txt or CON.mp3, aux.txt, lpt1.html, etc. is not allowed by Windows and can be leveraged for enumeration. However, what about reading a ...
burninator's user avatar
1 vote
1 answer
120 views

Ex Employee as Consultant

We are in process of going for SOC2 audit. I need your help in clarifying an HR element. The problem statement(s) is as below If we want to hire ex-employee of a company as a consultant what all ...
Amit's user avatar
  • 11
1 vote
0 answers
77 views

Design review/criticism of secure master-workers system

I am designing a system which will have one main process/service (master) which can potentially offload part of it's work to N number of external remote processes (workers). I want the worker ...
Michal's user avatar
  • 111
0 votes
1 answer
734 views

OpenSCAP Tailoring - Possible to change rule severity

Is it possible to change the severity of a rule using an OpenSCAP tailoring/customization file? UPDATE (2022-04-13): refine-rule seems like it could solve this but cannot find any documentation for ...
REA_ANDREW's user avatar
0 votes
0 answers
122 views

Use of JWT Token in open source project

I'm currently performing a code audit for an application that a company will release to the public as open-source in the next few days. In this application, they use a JWT token for authentication and ...
NeCro's user avatar
  • 25
1 vote
1 answer
1k views

What's suspicious about this event log?

I got an event that something is wrong with, but I don't understand what exactly. { "EventTime":"2021-11-22 21:05:45", "Hostname":"pc2", "...
Collide'n'Grap's user avatar
0 votes
1 answer
713 views

LAN Only Webserver

I am on a 192.x.x.x network and have a local server that hosts some webapps for the local users of the network. The server is running: Ubuntu VPN Nginx Reverse Proxy with the site.conf including: ...
nerdball8000's user avatar
2 votes
1 answer
123 views

Security requirements for small tax software business

I have a client who does payroll and taxes and is looking for a web app to easily communicate and transfer tax related documents for clients. I would assume that the IRS or someone would have some ...
user8890139's user avatar
0 votes
1 answer
133 views

How to perform security audit of a web service that uses google cloud's external HTTP(s) load balancer?

An independent security auditor discovered many open ports by using nmap while auditing a web service deployed on GCP. The service is a Cloud Run instance behind an HTTP(s) load balancer. The auditor ...
Raiyan's user avatar
  • 101
0 votes
1 answer
354 views

Third party consultants background checks, NDA signing etc for SOC-2

We are a SOC-2 compliant company. We used to have all full time employees till now, hence we could do our due diligence on all the hired employees e.g. Background checks, reference checks, getting NDA ...
Rakesh Goyal's user avatar
1 vote
1 answer
906 views

How could I know if a website is fingerprinting you via WebGL?

I would like to know if a website is fingerprinting me via WebGL, first of all, knowing if the site is doing it Knowing when they send the request to my browser Knowing what value I am reporting to ...
The Dan's user avatar
  • 111
0 votes
1 answer
202 views

Do the organisational policies need to have ownership to ensure accountability?

Policies are the high-level statement from Senior Management. It's a philosophy for the management to be guided by, and management has the direction to plan, build, run and monitor the activities to ...
RAmin's user avatar
  • 13
0 votes
1 answer
317 views

What alternative standard for ISO 27001 can be used in Australia?

I am looking for alternatives, that are less strict and less time consuming, than ISO 27001. Australia is in the Commonwealth, so maybe Cyber Essentials Plus could work, but I do not know if that ...
Maria Celeste Galera Laferrere's user avatar
1 vote
1 answer
188 views

What information should I collect when a user performs an action on a website? [closed]

In the development of an organization's web system (containing sensitive information) with credentials, where the actions carried out must be monitored, what information should I keep when each action ...
John's user avatar
  • 95
0 votes
1 answer
282 views

Synology logs SMB "Read" event false positives

We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
jtlindsey's user avatar
  • 225
1 vote
0 answers
254 views

AuditD and SysCall alerts

Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work? When an application gets executed do all the ...
Jason's user avatar
  • 3,126
0 votes
1 answer
325 views

How to start pentesting/reverse engineering/cracking a software on Linux? (Docker based) [closed]

TL:DR; What are good learning resources for security testing a software which runs with Docker on Ubuntu. I am in junior position at this company, and they figured it would be good if I just test ...
boblearningaboutsec's user avatar
2 votes
1 answer
200 views

PCI scope for a Direct-Post e-commerce site (SAQ A-EP)

An e-commerce site uses the Direct-Post method (see page 14 PCI e-commerce security). Is the server for the e-commerce application and network it resides on in scope for PCI? There are questions in ...
J. Lam's user avatar
  • 21
1 vote
1 answer
2k views

auditd rules for both 64-bit (b64) and 32-bit (b32) architectures

I'm looking at the OpenSCAP Security Guide for CentOS 7: https://static.open-scap.org/ssg-guides/ssg-centos7-guide-index.html Under "Record File Deletion Events by User" (as an example), it ...
cherdt's user avatar
  • 111
8 votes
2 answers
326 views

Do people even exist who actually vet all the updates to their open source software?

A year or so ago, I set up this system which, whenever Composer (that's PHP's packet/library update manager) fetched new updates to my few (but critically required) third-party libraries, created a ...
T R's user avatar
  • 81
-1 votes
2 answers
173 views

Election security is considered one of the most difficult problems in computer security [closed]

Not just electronic voting, but in election security general. I think it part is because there are many components to it, and it has many components that could be compromised. What are some of the top ...
London's user avatar
  • 7
0 votes
2 answers
257 views

Is there any such thing as an independent code vetting project which works for free to vet open source projects?

I'm sure I'm not the only one who is scared to death to blindly trust random strangers with all my data. Which is the case in practice if, for example, I'm to use this library right now, which I'm ...
X. Stoaks's user avatar
1 vote
1 answer
174 views

Is it possible to ensure detection and logging of all attempts to copy data out of a system?

I am cross-posting this question from Serverfault, because I am in doubt where it fits best. Say I have a server set up for processing sensitive data. The few authorised users of the system are ...
Thomas Arildsen's user avatar
0 votes
2 answers
218 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
Jason's user avatar
  • 3,126
4 votes
1 answer
165 views

Need help collating resources for an information/cyber security audit document for an MSP

I am currently serving out an internship with a small MSP (4 employees, 50-100 clients with between a couple and 100 employees). My main project is to work on a information/cyber security audit ...
Vehicular IT's user avatar
1 vote
1 answer
140 views

Monitoring User (developer) interaction

I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system. To expand a bit more about this, we have several systems that run ...
codingbunny's user avatar
2 votes
1 answer
690 views

Getting numerous HEAD requests by Java user agents to resources that require authentication to view within a web application. Should I block them?

I have recently started using Cloudflare's firewall in front of a web application. This app has a limited user base of selected applicants and they must log in to view anything. There is no public ...
BadHorsie's user avatar
  • 385
0 votes
2 answers
237 views

Difference between Web App Pentesting and Web App Security Audit

I'm having a hard time drawing the line between Web App pentesting vs a Web App Security Audit. For instance, OWASP Testing Guide could be used for both of those cases. Let's say the pentester and ...
botanga's user avatar
  • 437
0 votes
1 answer
161 views

IT security audit : is threat modelling key to reproducible success of just following a methodology (ex : ethical hacking)

To sum up the methodology of ethical hacking, what you do is : Information gathering (gets the IP, domains, etc...) Fingerprint the IP (what OS, what services are running, etc...) Vulnerability ...
botanga's user avatar
  • 437

1
2 3 4 5
10