Questions tagged [audit]

For questions about the assessment of software, hardware, systems, people, processes, procedures, projects, etc, that are somehow related to the security of an organization or product. Often these are related to a certification the organization or product holds, or looking for tools or processes for performing an audit.

Filter by
Sorted by
Tagged with
0 votes
1 answer
18 views

Questions on user context and auditing for background job execution for SaaS application

I have some questions related with user context and auditing for background job execution for SaaS application. Let's say an admin user scheduled a background job through UI. When the job start ...
0 votes
1 answer
168 views

Synology logs SMB "Read" event false positives

We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
0 votes
0 answers
24 views

System audit of hardened device regarding certificate handling

I am tasked with auditing the default configuration (system configuration, default applications...) that is set for some computers before they are given to users. Though I have never seen it anywhere, ...
0 votes
0 answers
38 views

Is Reading Windows Reserved Filenames Through a URL Valid for OS Enumeration?

I'm aware that writing a file with a reserved name such as CON.txt or CON.mp3, aux.txt, lpt1.html, etc. is not allowed by Windows and can be leveraged for enumeration. However, what about reading a ...
1 vote
3 answers
1k views

Where can I find a list of checksums for windows files? Why don't MS sign all their executables?

Is there anywhere I can download a list of checksums for microsoft-published OS executable files, preferably grouped by release name? I could do the same by decompressing files on a windows setup CD, ...
1 vote
1 answer
62 views

Ex Employee as Consultant

We are in process of going for SOC2 audit. I need your help in clarifying an HR element. The problem statement(s) is as below If we want to hire ex-employee of a company as a consultant what all ...
1 vote
0 answers
35 views

Design review/criticism of secure master-workers system

I am designing a system which will have one main process/service (master) which can potentially offload part of it's work to N number of external remote processes (workers). I want the worker ...
0 votes
0 answers
20 views

Nessus Scan failed: 5.2 Ensure 'file_priv' Is Not Set to 'Y' for Non-Administrative Users

Taking a look at the failure Description: The File_priv privilege found in the mysql.user table is used to allow or disallow a user from reading and writing files on the server host. Any user with the ...
0 votes
1 answer
181 views

OpenSCAP Tailoring - Possible to change rule severity

Is it possible to change the severity of a rule using an OpenSCAP tailoring/customization file? UPDATE (2022-04-13): refine-rule seems like it could solve this but cannot find any documentation for ...
6 votes
2 answers
1k views

Does git commit hash prove the history until that point?

I have some data and want to prove it's integrity during time, i.e. prove that a certain state of the data was present a a certain date. For this reason I commit the data to a git repository I keep ...
0 votes
0 answers
53 views

Use of JWT Token in open source project

I'm currently performing a code audit for an application that a company will release to the public as open-source in the next few days. In this application, they use a JWT token for authentication and ...
0 votes
0 answers
56 views

Is Antiforgery Validation really needed for Login page when external return URL is not allowed?

I fallen in a scenario that User opens two tabs for login page and try to login on both Instead of showing an error message to user (I can't think of a good meaningful message to explain antiforgery ...
2 votes
1 answer
124 views

PCI scope for a Direct-Post e-commerce site (SAQ A-EP)

An e-commerce site uses the Direct-Post method (see page 14 PCI e-commerce security). Is the server for the e-commerce application and network it resides on in scope for PCI? There are questions in ...
1 vote
1 answer
228 views

What's suspicious about this event log?

I got an event that something is wrong with, but I don't understand what exactly. { "EventTime":"2021-11-22 21:05:45", "Hostname":"pc2", "...
4 votes
1 answer
125 views

Need help collating resources for an information/cyber security audit document for an MSP

I am currently serving out an internship with a small MSP (4 employees, 50-100 clients with between a couple and 100 employees). My main project is to work on a information/cyber security audit ...
1 vote
7 answers
10k views

Does ISP have control on all routers in their network?

When I was changing my router my ISP technician told me that he has remote access to all routers provided by ISP. Was that true? If that is a fact it scares me...
0 votes
1 answer
138 views

LAN Only Webserver

I am on a 192.x.x.x network and have a local server that hosts some webapps for the local users of the network. The server is running: Ubuntu VPN Nginx Reverse Proxy with the site.conf including: ...
2 votes
1 answer
73 views

Security requirements for small tax software business

I have a client who does payroll and taxes and is looking for a web app to easily communicate and transfer tax related documents for clients. I would assume that the IRS or someone would have some ...
0 votes
0 answers
74 views

Tips for auditing/finding a better/trusted source for an anonymous but open source network device linux driver from some random github repo

Maybe because I am a cheap bastard or just because I saw no better alternative in the market in terms of reported performance and functionality vs. size, I bought this USB bluetooth/WiFi5 dongle: ...
0 votes
0 answers
47 views

Security Reporting Tool - Centralising Office 365 Security across Multiple Tenants

So let me paint the picture prior to asking the question: I'm part of an MSP who service a lot of clients managing 50+ Microsoft Office 365 Tenants. We have baseline security policies and structures ...
0 votes
1 answer
70 views

How to perform security audit of a web service that uses google cloud's external HTTP(s) load balancer?

An independent security auditor discovered many open ports by using nmap while auditing a web service deployed on GCP. The service is a Cloud Run instance behind an HTTP(s) load balancer. The auditor ...
0 votes
1 answer
173 views

Third party consultants background checks, NDA signing etc for SOC-2

We are a SOC-2 compliant company. We used to have all full time employees till now, hence we could do our due diligence on all the hired employees e.g. Background checks, reference checks, getting NDA ...
2 votes
0 answers
464 views

Why is Windows auditing svchost by default?

I would like to know why, by default, Windows set an audit rules on svchost.exe ? While it's used only when auditing is active, i don't understand why there's a special treatment for this file since ...
1 vote
1 answer
359 views

How could I know if a website is fingerprinting you via WebGL?

I would like to know if a website is fingerprinting me via WebGL, first of all, knowing if the site is doing it Knowing when they send the request to my browser Knowing what value I am reporting to ...
0 votes
1 answer
162 views

What alternative standard for ISO 27001 can be used in Australia?

I am looking for alternatives, that are less strict and less time consuming, than ISO 27001. Australia is in the Commonwealth, so maybe Cyber Essentials Plus could work, but I do not know if that ...
0 votes
1 answer
100 views

Do the organisational policies need to have ownership to ensure accountability?

Policies are the high-level statement from Senior Management. It's a philosophy for the management to be guided by, and management has the direction to plan, build, run and monitor the activities to ...
1 vote
1 answer
247 views

Does SOC1/SOC2 mandate installing non Security related patches

I am looking at our patch management control for SQL Server databases and until now the process only requires us to install security patches. Microsoft releases cumulative updates every month and it ...
1 vote
1 answer
149 views

What information should I collect when a user performs an action on a website? [closed]

In the development of an organization's web system (containing sensitive information) with credentials, where the actions carried out must be monitored, what information should I keep when each action ...
5 votes
2 answers
411 views

Can we determine how securely files are stored on a cloud storage service?

After asking two questions about the security of online cloud storage, it seems to me that we can only at best speculate as to the security practices of the hosting company, and believe what they tell ...
1 vote
0 answers
120 views

AuditD and SysCall alerts

Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work? When an application gets executed do all the ...
1 vote
1 answer
138 views

Questions to confirm a good standpoint on web app security?

What should be the questions asked to assess a company on web app security? Our company is in process of partnering with another company in order to outsource web app security work to them. For us ...
0 votes
1 answer
172 views

How to start pentesting/reverse engineering/cracking a software on Linux? (Docker based) [closed]

TL:DR; What are good learning resources for security testing a software which runs with Docker on Ubuntu. I am in junior position at this company, and they figured it would be good if I just test ...
1 vote
1 answer
600 views

auditd rules for both 64-bit (b64) and 32-bit (b32) architectures

I'm looking at the OpenSCAP Security Guide for CentOS 7: https://static.open-scap.org/ssg-guides/ssg-centos7-guide-index.html Under "Record File Deletion Events by User" (as an example), it ...
8 votes
2 answers
268 views

Do people even exist who actually vet all the updates to their open source software?

A year or so ago, I set up this system which, whenever Composer (that's PHP's packet/library update manager) fetched new updates to my few (but critically required) third-party libraries, created a ...
-1 votes
2 answers
130 views

Election security is considered one of the most difficult problems in computer security [closed]

Not just electronic voting, but in election security general. I think it part is because there are many components to it, and it has many components that could be compromised. What are some of the top ...
0 votes
2 answers
190 views

Is there any such thing as an independent code vetting project which works for free to vet open source projects?

I'm sure I'm not the only one who is scared to death to blindly trust random strangers with all my data. Which is the case in practice if, for example, I'm to use this library right now, which I'm ...
1 vote
1 answer
120 views

Is it possible to ensure detection and logging of all attempts to copy data out of a system?

I am cross-posting this question from Serverfault, because I am in doubt where it fits best. Say I have a server set up for processing sensitive data. The few authorised users of the system are ...
2 votes
2 answers
453 views

Can OSSEC detect buffer overflow attacks?

I am trying to detect buffer overflow by using OSSEC (a HIDS software) as mentioned in OSSEC rules example and OSSEC book. How can I configure OSSEC for detect a simple buffer overflow example as the ...
0 votes
1 answer
117 views

IT security audit : is threat modelling key to reproducible success of just following a methodology (ex : ethical hacking)

To sum up the methodology of ethical hacking, what you do is : Information gathering (gets the IP, domains, etc...) Fingerprint the IP (what OS, what services are running, etc...) Vulnerability ...
0 votes
2 answers
125 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
12 votes
2 answers
9k views

WireGuard VPN: how safe is it for production in its current state?

In our project we had to build a VPN to get through to computers residing behind NAT. I never did it before. While looking for suitable software I came across WireGuard which claimed to be very simple....
0 votes
1 answer
105 views

Monitoring User (developer) interaction

I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system. To expand a bit more about this, we have several systems that run ...
0 votes
1 answer
161 views

Difference between Web App Pentesting and Web App Security Audit

I'm having a hard time drawing the line between Web App pentesting vs a Web App Security Audit. For instance, OWASP Testing Guide could be used for both of those cases. Let's say the pentester and ...
2 votes
1 answer
341 views

Getting numerous HEAD requests by Java user agents to resources that require authentication to view within a web application. Should I block them?

I have recently started using Cloudflare's firewall in front of a web application. This app has a limited user base of selected applicants and they must log in to view anything. There is no public ...
0 votes
2 answers
1k views

How to restrict user access mobile data when mobile is connected to laptop?

When a user connects his mobile phone to a laptop in our organisation, his complete mobile data can be accessed from laptop. How do we control this and restrict the user from accessing mobile data ...
3 votes
2 answers
10k views

Can Google Policy Profile remotely erase all data on the device?

I'd like to configure my company's Google e-mail on my iPhone, however when enabling e-mail profile in Inbox, Gmail, Mail or any other app, the following Device Policy Alert is shown: To use Google ...
0 votes
1 answer
104 views

How can Linux service installation page create an attack surface?

Based on one of the lectures of Planning, Auditing and Maintaining Enterprise system course by Greg Williams (Department of computer science university of Colorado): Let's say they were installing ...
1 vote
2 answers
4k views

Is it possible to bypass this Xss Filter?

I was creating an XSS filter for my node plugin. Is there any way to bypass it? If yes How can i prevent it? function xSSFilter(str) { return str .replace(/&/g, '&') ...
4 votes
1 answer
1k views

Is it insecure to expose private bucket names through signed URL?

AWS provides signed url to objects in bucket.On backend we can connect with AWS and create such signed urls and send to front-endJust discussing this one use case where we use that signed url to make ...
0 votes
0 answers
146 views

Is attribute-based encryption safe for production use?

I'm very interested in attribute-based encryption (ABE). I see various working examples online, and I want to know, has it been verified as production-ready? What does it mean to have a security audit,...

1
2 3 4 5
9