Questions tagged [audit]

For questions about the assessment of software, hardware, systems, people, processes, procedures, projects, etc, that are somehow related to the security of an organization or product. Often these are related to a certification the organization or product holds, or looking for tools or processes for performing an audit.

Filter by
Sorted by
Tagged with
0
votes
0answers
39 views

How to deal with Registered Envelope Service (CRES) if you are not using this service

First of all, I am not using CRES, but many of our clients use it. I want to know the best approach to manage all communications with our clients that use CRES. I want to avoid using CRES webmail ...
0
votes
1answer
51 views

IT security audit : is threat modelling key to reproducible success of just following a methodology (ex : ethical hacking)

To sum up the methodology of ethical hacking, what you do is : Information gathering (gets the IP, domains, etc...) Fingerprint the IP (what OS, what services are running, etc...) Vulnerability ...
0
votes
0answers
23 views

How to make PDF-file post data on load?

I've been trying to create a .pdf file via msfconsole that would open cmd on a windows device and curl POST data to a server. I've previously checked this link and found the following: se exploit/...
0
votes
1answer
58 views

How can Linux service installation page create an attack surface?

Based on one of the lectures of Planning, Auditing and Maintaining Enterprise system course by Greg Williams (Department of computer science university of Colorado): Let's say they were installing ...
2
votes
1answer
102 views

Is it insecure to expose private bucket names through signed URL?

AWS provides signed url to objects in bucket.On backend we can connect with AWS and create such signed urls and send to front-endJust discussing this one use case where we use that signed url to make ...
0
votes
0answers
106 views

Is attribute-based encryption safe for production use?

I'm very interested in attribute-based encryption (ABE). I see various working examples online, and I want to know, has it been verified as production-ready? What does it mean to have a security audit,...
0
votes
0answers
39 views

Any security standards applicable to empty S3 buckets?

My employer has a lot of S3 buckets which are no longer used or are just sitting there empty. Cleaning them up would obviously reduce the attack surface and be less to monitor and secure, but that ...
0
votes
0answers
89 views

How to Ask for More Transparency from Companies Handling Our Personal Data

A company's asked me to submit a scan of my passport claiming KYC (Know Your Customer) and AML (Anti-money Laundering) purposes. In times of daily data breaches, what can we ask for a company to be ...
0
votes
0answers
85 views

Could this be considered lateral movement or is this normal activity?

Has anyone encountered this type of logon (4624 Type 3). The accounts are logging on then off within a few seconds. We are noticing this activity in the morning, which would be when they start working....
1
vote
0answers
40 views

saving entire Windows event log for auditing & preserve digital evidence

As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down. ...
86
votes
6answers
20k views

How am I ever going to be able to “vet” 120,000+ lines of Composer PHP code not written by me? [duplicate]

I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
0
votes
3answers
150 views

Providing password review results to auditors

The IT Security department is getting audited and the auditor had approached our IT Security team and requests to see results of the password review process, which compares existing database of ...
3
votes
1answer
129 views

When a closed-source company hires somebody to audit their code, is the auditor forced to do it in the company's office?

Let's say that ACME, Inc. is making closed-source software. It's closed for a reason (they don't want it leaving their building other than in compiled form). Now, they are hiring some company/person ...
4
votes
3answers
157 views

How do we cross-verify if the device is doing exactly what it is supposed to do?

How do we know any device is doing what it is supposed to do? For example, Android is an open-source OS (ignore google libraries for now) and they do claim that all passwords will only be stored on ...
0
votes
0answers
61 views

Sony Access Log (Playstation Network) does not exists

Yesterday my wife receive some emails from Sony confirming her purchases on Playstation Network. The only problem is: she was with my side watching Netflix on the smart Tv. The purchased items is a ...
0
votes
1answer
101 views

Rails File.open(#{Rails.root}) is vulnerable to LFI?

I am performing White Box testing on Rails application with static code analyzing tools like brakeman, I came across an instance where the developer is loading images using file.open. file = File....
0
votes
0answers
61 views

Learning how to audit a linux system, what does it mean to configure password & system auth?

I'm currently using Linux Red Hat OS, and I need to configure it accordingly to /etc/pam.d/password-auth and /etc/pam.d/system-auth under CIS Red Hat Enterprise Linux 8 Benchmark v1.0.0-1. What page ...
1
vote
1answer
109 views

Security requirement for an R&D team [closed]

I have an R&D team that has been recently set up. I have been asked to help out with the cyber-security requirements for the department. They require access to anything and everything available on ...
0
votes
1answer
91 views

Is it ok and useful to keep a security audit report after completing an audit?

I recently ran a couple of security audits for some friends, and was thinking about doing some more. Before I do though, I wanted to know whether I should keep the audit reports and, if so, how? I ...
1
vote
1answer
96 views

Security and the Definition of Ready and Done [closed]

Currently I am in a project where I have to test REST APIs among other things. In another question of mine I also discussed the topics Definition of Ready and Definition of Done regarding security. ...
0
votes
2answers
129 views

Rest API Security Guideline. Developer Rules? [closed]

In my current project I am also setting up the area of security testing. So far there was no way to use security within the REST API development. Beside the known approach, e.g. using static software ...
0
votes
1answer
85 views

Security test within a staging environment. Is SOAPUI sufficient as a test tool?

Currently I am working on a project in which I am supposed to define the following aspects as a test manager: Conception of a penetration test for a test staging environment Planning security ...
0
votes
0answers
43 views

Should I Pursue Platform-Ownership?

the context is this introduction in an HP whitepaper. I'm inquiring about "platform-ownership" within the Secure-Boot environment. I'm looking for a simplified summary of platform-ownership. Much of ...
1
vote
1answer
63 views

Tool to prepare report of security auditing [closed]

I was doing dorking on my friend's website to make sure there is no leak of information that is not meant to be. I found domains and sub-domains in search results. Is their a tool which can help me ...
-1
votes
2answers
275 views

How to perform a security test/review/penetration testing of Ethernet ports?

I have been engaged by a client who wants its Ethernet ports checked to determine whether port security is functioning effectively. What can be the approach or steps to do check Ethernet port ...
1
vote
1answer
68 views

Does SOC1/SOC2 mandate installing non Security related patches

I am looking at our patch management control for SQL Server databases and until now the process only requires us to install Security patches. Microsoft releases Cumulative updates every month and it ...
2
votes
2answers
90 views

How can I log access and usage of a MySQL database?

I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current ...
-4
votes
3answers
135 views

Is code obfuscation common in FOSS?

I am a learner of FOSS licensing, security and privacy. I ask this question because one of the arguments persuading users to use or switch to FOSS is the fact that since the code is open, an expert ...
1
vote
1answer
97 views

Are there technical framework for IT sec audit just like there are management frameworks?

TL;DR Are there technical frameworks (processes with checklists ruled by international standards like COBIT, ISO 27000) for IT security analysis/auditing ? Hello, Let's say you're a software ...
1
vote
0answers
125 views

Instance metadata on IBM Cloud [closed]

Is there any way to get instance metadata on IMB Cloud (a.k.a Bluemix) K8s cluster, from a compromised pod? Something like doing curl to http://metadata.google.internal/computeMetadata/v1/instance/......
0
votes
4answers
173 views

Can revealing Intranet address become a security threat?

If I publicly list my company's intranet and extranet website addresses, is it a risk?
0
votes
2answers
77 views

Securing Home Network using 3rd Party Firmware / Access Points

I've been having some trouble on my home network and thought that having a router as an AP would help fix these attacks. At first it did, but now it seems the attackers have gotten through. For all I ...
1
vote
1answer
179 views

How could the Chinese Communications Authority find a backdoor on my website?

I host a legacy HTTP website on my own hardware in China. It was attacked due to the Struts file upload flaw last month. But yesterday, Communications Authority in my province alarmed me, there is ...
3
votes
1answer
306 views

Are there any known vulnerabilities in libre office password protection for *.odt files?

I was looking for a source to determine the safety of password protection in libre office. The thread at ask.libreoffice.org suggest its save to use. However the thread is rather old and it is hosted ...
1
vote
2answers
785 views

Is it possible to bypass this Xss Filter?

I was creating an XSS filter for my node plugin. Is there any way to bypass it? If yes How can i prevent it? function xSSFilter(str) { return str .replace(/&/g, '&') ...
3
votes
1answer
67 views

Verifying Security of a Custom Network Protocol

I’ve designed a custom network protocol using high-level LibSodium primitives for authentication and encryption. The purpose of the protocol is for a game, and the security is to ensure only paid ...
1
vote
0answers
141 views

127.0.0.1 host header injection

I would like to know if this configuration is vulnerable to host header injection. I think it isn't, because it's listening on localhost, but I'm not sure. <VirtualHost 127.0.0.1:[% port %]> ...
2
votes
1answer
879 views

Security Audit on AWS - question on findings

Just wondering about an assessment I'm doing regarding a client's AWS environment. I'm new to AWS to I'm having to learn a lot on the go. I used ScoutSuite and got some findings, specifically: EC2: *...
1
vote
1answer
620 views

Windows event log - Security - Audit failure

Every one hour or so I have this event in my Event viewer -> Windows logs -> Security log. I understand the consent.exe is Windows' UAC control, what i wan't to know is why and what is trying ...
1
vote
0answers
93 views

Where to find security information about Common Lisp, SBCL and some others Lisp libraries?

I am currently developing some web tools (http server, peer to peer, ...) in Common Lisp, and I deal with datas such as ledger transactions for cryptocurrency systems or payments via Braintree/Paypal. ...
3
votes
1answer
76 views

What tools and techniques do we have at disposal to manually search for rootkits?

I use tools from sysinternals for various tasks (ex. process monitor), but I'm not sure if these programs can be used to manual rootkit detection since rootkit processes can be hiden. Are there any ...
1
vote
1answer
62 views

How can I ensure consistent privacy policy of my DNS server to that of the TLD's privacy policy?

Whenever I query example.com, one of the TLD root servers for .com will be queried for example.com. This query includes my IP address, and in theory could be used to identify my browser session. ...
2
votes
0answers
72 views

Can ISO 27001 auditors audit their own work?

It may seem that the question in the title is stupid, but it is not. There is a known case of deletion of "Auditors shall not audit their own work" rule in 2015 version of ISO 9001 and the remaining ...
0
votes
2answers
94 views

Detecting Spoofed InDesign File Creation Date

I apologize for turning here with a question, my research both searching here and on Google has only turned up useless information. I believe that someone has sent me files that have had their file ...
0
votes
1answer
239 views

Should Session-Timeout events be logged

I am working on Audit logs for an ERP project and searching for all kind of events to be logged. In this project, session, timeouts on inactivity. I was wondering if logout by session-timeout should ...
0
votes
0answers
32 views

Was ISO 17799:2005 the first ISO standard to introduce risk management?

I'm doing research into ISO 17799:2005, more specifically its policies related to risk management and its involvement on risk management in the wider IT sector, but I can't find out the answer to: ...
1
vote
1answer
331 views

Security auditing - disabling IP forwarding and ICMP packets redirects

I've recently started working as a security auditor and my mentor gave me some homework to write an Ubuntu security audit script so that I'll get to learn to use batch scripting and understand ...
0
votes
1answer
43 views

What would be the best way to evaulate the database management systems? [closed]

I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
1
vote
0answers
46 views

UDF Client, Socket Binding and Tags Hack - Need Help [closed]

Background For a long time now, I've been working to remove a persistent, if not permanent, malware presence on my computers and phones. Every attempt at removal has been unsuccessful to date, by me ...
1
vote
1answer
121 views

What information should I provide to third party pen testers - (black box penetration)

I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have ...

1
2 3 4 5
9