Questions tagged [automation]
The automation tag has no usage guidance.
38 questions
1
vote
1
answer
121
views
Automate ASVS with ZAP
I am new to this role. So I am trying to understand a few things.
My organisation wants to evaluate the existing application according to ASVS https://github.com/OWASP/ASVS/blob/master/4.0/docs_en/...
- 117
0
votes
0
answers
93
views
Are centralized credentials an antipattern?
At my organization we have a lot of servers. We have many common manual maintenance tasks that we'd like to automate. There's currently three approaches we're fighting over internally:
Ops engineers ...
- 1
2
votes
3
answers
170
views
Should one be concerned about public keys being copied to wrong servers accidentally?
I am currently automating the setup of a web server with Ansible. My two team mates should be able to run the Ansible playbook as well. Therefore, their public keys need to be added to the ...
- 121
1
vote
0
answers
64
views
Projects similar to SCAP Security Guide
Are there any other projects similar to what SCAP Security Guide (SSG) is doing? Automated security policy compliance using Ansible playbooks and Bash scripts.
I'm trying to put my systems in ...
- 11
0
votes
0
answers
231
views
Secure method of creating sudoer password through cloud-init
We have automated a lot of things for server startup via cloud-config, and I want confirmation about whether there is any security concern in the following.
users:
- name: myuser
groups: sudo
...
1
vote
0
answers
175
views
Is Arduino Mega Hackable Over The Air
I am collecting data (by reading input registers) from a machine by RS-485 protocol and Arduino Mega 2560 hardware.
I am also sending this data from Arduino Mega to a NodeMCU which is connected to the ...
0
votes
0
answers
382
views
SQLmap automation
I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)?
The tool doesn't support ...
- 11
1
vote
1
answer
178
views
Use linux firewall rules for windows too [closed]
I'd like to improve security on my home network.
I have a PC and a laptop with Microsoft Windows as well as a PC and a laptop with Linux
There are a few HTTP services installed in the network. The ...
- 715
1
vote
1
answer
134
views
Any campus email systems automatically testing links? [duplicate]
I heard that there are some university campus email systems that "click" all the links on incoming emails and thus inadvertently unsubscribe recipients from email distribution lists if the email ...
- 2,119
2
votes
2
answers
423
views
Fetching GPG private key from Linux server to decrypt files on a Win 10 computer in production
I have a need to fetch automatically the GPG private key from a Linux server to decrypt files on a Windows 10 computer in production.
There are a few challenges here:
How to assure SCP from the ...
- 121
1
vote
0
answers
107
views
There is a difference between malware detection using automata and family behavior graph?
Is there a difference between dynamic malware detection using automata and family behavior - graph?
I think that they are both relying on API function calls but I don't understand if there is any ...
16
votes
4
answers
8k
views
Do mail servers follow links in emails as part of a security scan before inbox delivery?
I've implemented a passwordless login using a magic link and email. The link can be used only once. One customer is complaining that once they click the link, the page reports that the link is already ...
- 271
3
votes
1
answer
559
views
Network with one possible unsecure device and one home assistant device
Background:
I have a google home and I plan to buy 1 or 2 cheap cameras to monitor my home when I'm not in it. I plan to have the camera connected to a wifi plug, so I can switch it off via the app ...
- 483
1
vote
1
answer
790
views
How to set autorunscript of core commands?
I'm trying to automate scripts of an Android Metasploit payload. I can successfully automate any script on the /post module, however, I'm trying to automate geolocate, dump_calllog and others that are ...
0
votes
0
answers
45
views
looking for computer readable lists of CVE to package name sources [duplicate]
Redhat has a very nice xml containing all known CVEs and the package version they are fixed in (https://www.redhat.com/security/data/metrics/rpm-to-cve.xml).
I would like to know if any other Linux ...
- 175
9
votes
1
answer
1k
views
Automatically Open LUKS Container on System Boot in a safe manner
I have a linux system running at a cloud provider where I created an encrypted container using LUKS to store personal data.
The encrypted container is manually mounted at /srv; the rest of the ...
- 1,325
2
votes
2
answers
2k
views
Pros and cons of installing security updates automatically?
I recently got into a discussion regarding automatic installation of security updates. The system is used and managed by a small nonprofit organization—essentially one or two admins managing the ...
- 495
12
votes
2
answers
13k
views
Anti-bot JavaScript library identification
I'm doing a research on anti-bot measures that websites can use to prevent automation. I came across a JavaScript library and I'm trying to identify its origin. At first I thought it's a site specific ...
- 223
3
votes
1
answer
2k
views
Port-forwarding to a web server on Raspberry Pi
I've recently created a relatively simple smart Christmas tree which is a Raspberry PI Zero W powered LED strip.
In order to control it via IFTTT webhooks, I've started a lightweight flask server on ...
- 1,625
1
vote
1
answer
408
views
Give users a powershell script to run - Secure?
Is there a secure and practical way to give a group of users a powershell script to run on their laptops?
The users all have active directory accounts, but their computers are not joined to any ...
- 153
5
votes
2
answers
741
views
Incident Responders: Can you give some examples of Incidents / types of incidents that are suitable for fully or partly automated response? [closed]
You setup security monitoring - either a full commercial SIEM/SOC or something home-cooked (e.g., rsyslog -> OSSIM / MozDef / Splunk / ...).
You also setup some rules so that some event triage is ...
- 2,656
3
votes
1
answer
371
views
IFTTT maker channel and Security Concerns
This is about IFTTT Maker Channel and security around it. They announced a new Maker Channel recently where you can receive and make web requests for automation.
For example, I can turn ON/OFF my ...
- 1
3
votes
2
answers
3k
views
How safe are the password prompts of the SafeNet eToken 5110 or similar cryptographic hardware tokens?
I'll need to use an hardware token, specifically the SafeNet eToken 5110 that comes with DigiCert's EV certificates, for code-signing on Windows.
I know that they issue a prompt to manually enter the ...
- 280
0
votes
1
answer
194
views
About Wikipedia section about Malware for AutoHotKey [closed]
I would appreciate your advice about the Wikipedia section about malware for AutoHotkey, please.
Because AutoHotkey contains many powerful automation tools, it is sometimes used to create malicious ...
- 101
1
vote
2
answers
907
views
Wireshark decrypt and save wireless packets from command line [closed]
I have a question that I can't seem to find a complete answer for. This may not be something that is possible, but I am hoping someone will have a solution.
At my work, we process wireless sniffs in ...
user143532
2
votes
3
answers
4k
views
How to tell if human is using website or automated script?
I know some websites say in their terms and services that the website can only be accessed by humans and not bots or scripts. How do they tell who is accessing? Especially with tools such as ...
- 10.2k
4
votes
3
answers
331
views
Did information technology had a increase or decrease in security with the introduction of automatic update features?
For obvious reasons we teach users
Always update... updates are good... never forget updates, et cetera!
Apart from the danger of malicious advertisements that make use of that showing users ...
- 7,056
2
votes
1
answer
626
views
What security considerations should I keep in mind when setting up home automation using IFTTT?
My next personal project is going to be setting up some basic home automation for my parents (not very tech savvy but have a potential to learn). This involves some thermostat, lighting and ...
- 3,286
2
votes
1
answer
181
views
What are proper methods to automatically detect malware and are current methods reliable? [duplicate]
What I have seen so far is the ability to automate signing hashes and string offsets as a way for an AV-engine to detect possible malware. Does this prove to be a good strategy for malware detection? ...
- 21
4
votes
1
answer
18k
views
How can I list all self-signed certificates in my stores on a Windows client?
I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...
- 43
2
votes
1
answer
146
views
How can I improve and secure automated signing?
Automated signing of files, such as software packages or file backups, is inherently risky if a certain level of trust is given to it. Having signing be an automated process means that there's no user ...
- 6,843
1
vote
2
answers
1k
views
Application that uses USB token to assign user on a server
I have the following situation:
One user with a USB token certificate access a site and log-in using this certificate, the logging process ask for the USB token password;
When the user is logged he ...
- 111
3
votes
1
answer
1k
views
Automate certificate signing in Linux
In a private network I wish to automate signing for new clients/servers.
Something like this:
New client is created (dockers & etc)
The client create a new private key and a CSR
The client send ...
- 203
9
votes
1
answer
6k
views
How to detect whether a GnuPG private key has passphrase on it from a script?
I've written a script to help our developers store a copy of their private keys without a passphrase inside our Puppet tree (not committed to Git) so our Vagrant boxes can use Hiera with eyaml + gpg (...
- 191
0
votes
2
answers
4k
views
Getting the uploaded file path without knowing the uploading destination
Imagine a scenario that we are able to upload a PHP file on the server. However, we are not aware of the uploading path. I simply mean that, we are able to upload the file but we don't know where it ...
- 113
0
votes
1
answer
459
views
Automated server security testing best practices?
Is there a standard way of automatically testing the basic security of my web server? I've found a couple on-line services, (e.g. http://hackertarget.com/), and they seem ok, but I'd like to start off ...
- 131
2
votes
3
answers
160
views
How do to keep programs updated
We all know we should keep our programs up to date, after all each of them could have an unlatched security hole that was fixed in the latest update. However the average computer easily contains 200+ ...
- 353
5
votes
1
answer
655
views
Security in automated systems using Puppet and Chef
In an extremely interesting presentation at Puppet Camp London, Tomas Doran suggested a pretty radical approach for keeping everything automated by managing tons of Docker containers with Puppet.
As ...
- 6,843