Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [audit]

For questions about the assessment of hardware, software, systems, people, processes, projects, etc, that are somehow related to the security of an organization or product. Often these are related to a certification the organization or product holds, or looking for tools or processes for performing an audit.

0
votes
0answers
25 views

Cheap(er) HSM FIPS 140-2 [on hold]

I'm currently building a project including electronic signature that requires the eIDAS certification. Currently, the eIDAS certification requires an HSM with the FIPS 140-2 Level 3 norm. But these ...
1
vote
0answers
27 views

UDF Client, Socket Binding and Tags Hack - Need Help [on hold]

Background For a long time now, I've been working to remove a persistent, if not permanent, malware presence on my computers and phones. Every attempt at removal has been unsuccessful to date, by me ...
0
votes
1answer
78 views

What information should I provide to third party pen testers - (black box penetration)

I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have ...
1
vote
0answers
37 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
0
votes
0answers
6 views

Resolving XML External Entity Defect in message audit service?

A corporate code analysis tool identified a security vulnerability in a web service that my team maintains. It identified an XXE (XML External Entity) vulnerability in this service and referenced the ...
0
votes
1answer
75 views

Which type of authentication is not prone to man-in-the-middle attacks?

I am preparing for the CISA exam and come across material saying "challenge response-based authentication is prone to session hijacking or man-in-the-middle attacks". But the material doesn't mention ...
1
vote
1answer
45 views

Is it possible to detect if a trojan or program sends information by sniffing the network of a VM

Explaining better, I was consulting on how I can ensure that the programs of an operating system does not perform any suspicious activity with my information, and I have been told that electronic ...
0
votes
1answer
46 views

Security Incident File Change Timestamp

How can I obtain all timestamps of all files ( starting"/") on a Linux system in order to verify if a file was changed within a breach?
0
votes
2answers
47 views

What are the main security concerns for Enteprise Software running on internal networks?

What do Enterprise Security teams test when they buy third party products, before they sign the check? Presumably they have a standard despite the main protection being the firewall and IDS. Is ...
1
vote
2answers
127 views

Security code review recommendations [closed]

I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
1
vote
1answer
100 views

Open Source Security Audit

I recently forked a project on GitHub that had been abandoned, cleaned up a lot of the code and started to make improvements to it. As it's a forked project I'd like to find out what the best way to ...
2
votes
1answer
94 views

How to use CIS Benchmarks without being a CIS member

I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be ...
2
votes
4answers
324 views

Is it safer to trust software/company that has been hacked in the past?

Which is better, when you have choices between 2 competing products: First one, which has never been publicly reported about being hacked or having security holes or Second one, which has had bad ...
2
votes
4answers
112 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
1
vote
0answers
57 views

How to determine who turned off security logging on my windows server?

We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't ...
0
votes
1answer
40 views

Python hazmat danger

Is hazmat considered to be secure? Here is a quote from their docs: This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing ...
1
vote
1answer
60 views

auditd-like software for Windows?

I need to know how to log users and admins activity on Windows, like auditd does on Linux. After searching, the only thing I found was this Audit account log-on events policy option for Windows 7. ...
2
votes
2answers
97 views

Does an admin need legitimaly to access his own logs generated by auditd?

In my understanding, admins need to access logs of the servers, workstations, services and applications they manage, either for administration or debugging purposes, never to logs generated by auditd ...
2
votes
1answer
72 views

SOC 2 audit for small business (6 employees) with no IT department [closed]

One of our clients is demanding that we complete a SOC 2 Type II audit. There is no way we will meet the standard, and, considering we only handle publicly available data, it is ridiculous that they ...
0
votes
1answer
55 views

What is the best way to know current attack for a server machine? [closed]

I'm hosting centos 7 servers which are exposed to the risk of malicious attacks. I have to protect the machines from the attacks. What is the best way to know how to protect attacks from system ...
0
votes
0answers
26 views

How to prevent Oracle TNS protocol sending data in plaintext?

I am doing a security audit and discovered an Oracle Server pulling data from an ODS server in plaintext. I am able to sniff the traffic from one of the internal servers. Essentially, the Oracle ...
0
votes
0answers
28 views

Determine CVEs impacting a version of the Linux Kernel

I inherited a small fleet of Linux boxes at work, which run an old version of Linux (3.10.83). The kernel was apparently hand-built from sources from kernel.org, it did not come from a distro). What's ...
1
vote
0answers
19 views

Certification courses from a novice to professional [closed]

I would like to know the list of certification courses that I can start as a beginner and become proficient in the field of network security and from which website or institution can I take the ...
1
vote
1answer
52 views

PCI Compliance Scan & Globalscape EFT Web App Cookies Not Marked Secure

I have a situation where we are performing external PCI compliance scans against our Globalscape EFT server. The scan is reporting: HTTP (443/tcp) - Web Application Cookies Not Marked Secure Per our ...
1
vote
1answer
40 views

Auditd logging related to SELinux? [closed]

Is there any relation between auditd and SELinux? Or can we use auditd even if SELinux is disabled?
2
votes
2answers
231 views

Is it a good idea to upload your gnupg files to github?

I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?
0
votes
1answer
583 views

Kali Linux and Cell Phone Security

Are there any built in tools/programs in Kali Linux that specifically target cell phones? Furthermore, do any of these tools/programs work remotely without sending a listener to the target?
1
vote
0answers
22 views

Hadoop Transparent Data Encryption: protection from interference of EDEK, EZK and DEK

I am preparing a response to a security auditor. They have presented a generic question about the protection from substitution of KEK and DEK in a "normal" encryption mechanism. What protection ...
1
vote
1answer
185 views

Authy reviewed? [closed]

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on ...
1
vote
1answer
100 views

Is IP address whitelisting useful if the IP address is not “secret”?

I'm working on an application that will have access to API keys supplied by our users. The application makes API calls on behalf of our users. The API we're using allows users to whitelist IP ...
3
votes
3answers
635 views

How to assure my customer that my software is malware proof?

We are delivering an application which our customers can use on their network cluster. Now, is there any way that we can certify that the software is malware proof and is not going to spread malware ...
114
votes
19answers
27k views

Is it common to allow local admin access for developers in organizations?

I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people). Recently due to security concerns our IT and ...
1
vote
0answers
92 views

Is there any modern scalable way to do system call monitoring?

I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
1
vote
0answers
17 views

OpenVPN Invalid Logins lock with PAM

We are getting dinged on a federal audit because OpenVPN does not appear to support invalid login restrictions (i.e., only 3 before the account is locked). Has anyone else experienced this? We are ...
6
votes
1answer
167 views

Is this file sharing approach safe?

I am currently developing a piece of software where files need to be uploaded and then shared with other people that are not on the platform itself. Here is my approach on encryption: A user has a ...
0
votes
0answers
86 views

ANSSI/ PASSI standard

I am looking for more information on the ANSSI/ PASSI standard, which I am guessing (based on limited information on google) is a French cybersecurity or data and privacy protection regulation or ...
2
votes
1answer
52 views

Windows: What are the security implication of adding Network Service account to “Event Log Readers” group?

I want to read security audit logs from a network service. By default, Network Service does not have permission to read but it can if the account is added to "Event Log Readers". One of the examples ...
0
votes
1answer
2k views

OpenVas gets stuck on some scans

We have been using OpenVas to scan our servers for months now. Recently the scans are getting stuck on different %, always below 30%. We did not change anything in my local configuration. I read a ...
0
votes
0answers
18 views

Is the ISecGrade Auditing Framework suitable to formulate a security audit application?

We are developing a checklist based auditing application (more of a self-audit type). Most of the questions will have yes no options only. For that reason we are looking for a checklist based format ...
0
votes
2answers
114 views

Auditing user emails (illegal?) [closed]

I'm the systems administrator for a company that does a lot of outbound emails and a lot of inbound emailing to potential clients. We've had a email auditing tool running for a couple weeks that ...
5
votes
2answers
2k views

WireGuard: what's wrong with this automatic IP assignment

WireGuard is extremely simple and fast kernel-space VPN based on modern cryptography. I want to use it in production and need automatic IP assignment for new peers. The project provides two short ...
1
vote
1answer
88 views

Does a SOC 2 SSAE report not come with a “seal of approval” from a certified auditor?

I'm studying for the CCSP exam and I'm confused with a test prep question in my study materials. The question reads: "Which kind of SSAE report comes with a seal of approval from a certified ...
-1
votes
1answer
49 views

Standards and Guidelines Pro/Con Anti Malware programs

For a whitepaper about anti-malware products used in combination with (server side) applications and infrastructure components (database server) I am looking for standards, guidelines and codified ...
6
votes
1answer
2k views

WireGuard VPN: how safe is it for production in its current state?

In our project we had to build a VPN to get through to computers residing behind NAT. I never did it before. While looking for suitable software I came across WireGuard which claimed to be very simple....
1
vote
1answer
32 views

How to verify Ruby on Rails projects are at current patch levels?

I've got a few Ruby on Rails systems running Ubuntu 14.04LTS. The Ubuntu version of supported Ruby is 1.9.1 but the developers use a Gemfile and Bundler which (AFAIK) installs Ruby (and gems) out-of-...
3
votes
1answer
311 views

What are the basic points to check during a systems audit? [closed]

I work in the petroleum industry and I am 'the young geek'. As such, I am often tasked with writing VBA macros, a bit of JS for data visualization and so on. Lately, I have been assigned the task of '...
2
votes
0answers
72 views

Need Security advice on virtualization and windows security

I have a little doubt about the security of my virtual machine and Windows. Can anyone please point me in right direction? Below is my what, how and why I made my virtual machine. Let me tell you ...
3
votes
2answers
207 views

Security Configuration Audit - CIS benchmarks

I'm trying to conduct a comparative study between the standards used to conduct a security configuration audit. I only found CIS benchmarks. If you could suggest some more known standards it would be ...
1
vote
0answers
88 views

Auditing specific SAM_USER events in Windows 2012 R2 Active Directory

I'm trying to create logs in Windows Event Viewer for when a user uses "net user /domain [USER]". So far what I've done was enable the Audit SAM event in Local Group Policy, and it appears to work. ...
0
votes
0answers
146 views

Auditd not writing to log after clearing without a service restart

I noticed that if everything is working fine with auditd on Ubuntu, and then the log at /var/log/audit/audit.log is cleared (all the text erased, the file is not deleted), auditd will no longer log ...