Questions tagged [monitoring]
Monitoring is the act of looking on the processes or systems for performance, supervision and surveillance.
169
questions
1
vote
1answer
60 views
Is it possible to ensure detection and logging of all attempts to copy data out of a system?
I am cross-posting this question from Serverfault, because I am in doubt where it fits best.
Say I have a server set up for processing sensitive data. The few authorised users of the system are ...
0
votes
1answer
76 views
Cant see data packets when capturing in monitor mode
On linux kali. I got an Atheros wireless adapater. I'm trying to capture data packets off the air and decrypt them as an exercise. I apologize if this question is silly. The problem is that when I ...
1
vote
0answers
48 views
Security Best Practice - Monitoring a Site-to-Site VPN Tunnel
if a customer wants to monitor an IPSec-based site-to-site VPN and basically no incoming traffic is needed, would you recommend:
a) setting up a permanent tunnel that can be monitored all the time and ...
0
votes
1answer
63 views
Monitoring User (developer) interaction
I'm looking for a "tamper proof" way, if there is such a thing, to monitor what a developer/engineer does on a given system.
To expand a bit more about this, we have several systems that run ...
0
votes
1answer
81 views
Monitoring laptop activity while logged into school's Microsoft account [duplicate]
I logged into my school-based Microsoft account on my personal laptop. But is it possible that somehow my school is monitoring my Google searches and other browsing history through the school ...
1
vote
2answers
79 views
Computer monitoring while working at home [duplicate]
I have a computer from the company and, while working at home, I would like to know if the company could be capable of monitoring or spying on my computer.
I am not connected to any company's server ...
0
votes
1answer
66 views
Re-use an old employer's laptop and avoid monitoring software
I still have an old good laptop from my ex employer that they never requested at the time I left (i assume it was old already by then)
I would like to reuse this computer and not have the risk of ...
1
vote
1answer
59 views
Can my school see the websites I've visited while on my home WiFi after I reconnect to the schools? [closed]
I know that they can't monitor me on my home WiFi, but can they see the websites I visited while on my home WiFi after I reconnect to the schools?
2
votes
2answers
82 views
What kind of data can be monitored/intercepted/altered by the VPN service provider? [duplicate]
As you may know, Virtual Private Network or VPN is a system to create an encrypted tunnel between two computers on the internet, on one end is the VPN client, and on the other end is the VPN server. ...
1
vote
1answer
86 views
How to detect use of personal NAS devices from corporate machines?
We have an issue where people are taking laptops home and connecting them to their personal home networks in order to backup corporate data to their private NAS devices. From a DLP standpoint we have ...
3
votes
1answer
491 views
Is accessing /proc/ inside docker container a security breach?
In a docker container I am reading the files /proc/stat and /proc/meminfo. As I understand they are the ones of the host. (Not local to the docker container)
In a meeting, a co-worker said that this ...
5
votes
1answer
834 views
Can the GlobalProtect VPN of my company track websites when Disabled?
I just installed the Global Protect VPN from my company on my local machine so I can access our servers remotely. I just "agreed" to the following statement:
VPN Connected
This system is for ...
0
votes
1answer
231 views
Forced to install certificate on my laptop when using company WiFi. Risk? [duplicate]
My company has a 'bring your own device' policy. You connect your device to the WiFi, and then open a citrix environment through a web portal. Basically, everything inside the citrix env is company-...
0
votes
0answers
27 views
critical files to be monitored by file integrity monitoring solutions in active directory servers
We are implementing file integrity solution on Microsoft active directory servers,
I need to know the critical paths(files and folders and registry keys) that need to be monitored for any change or ...
1
vote
1answer
102 views
Where do live threat maps get their threat-data from? [closed]
There are many "threat maps" online such as Norse, Fortinet etc serving accurate information of all kinds of attacks around the globe such as DOS, Scans, Pings, and many more.
How accurate is this
...
1
vote
1answer
314 views
What ways can you monitor all changes made on a Linux server?
Sometimes we have contract developers that need to do work on the server (via ssh or sftp) and I've been looking for ways to monitor what they do on our Debian based server. We have ways of limiting ...
3
votes
3answers
327 views
How do you protect against your IT domain admins accessing your data?
I work at a small company and we use an external company to take care of all our IT needs (a "managed IT service provider"). This includes managing our windows domain, our network, and everything else....
0
votes
1answer
61 views
Capturing multicast packets in WLAN
(I had to move this from Network Engineering stack exchange where I origianlly asked this question)
If a device in monitoring mode snoops on the traffic in a WLAN, can it CAPTURE and READ multicast ...
1
vote
1answer
107 views
Securing a Personal Hotspot
I'm buying a brand new phone, added to it: a new line and SIM card, along with a brand new laptop, to use my phone's network as a hotspot. I will not be using these devices for anything but personal ...
1
vote
2answers
179 views
If a vulnerability has no relevant attack vectors, is monitoring still legitimate for a company?
Today while reviewing vulnerability scan results with a colleague, we had a debate about what vulnerabilities can be considered "true or legitimate" and hence worthwhile to spend resources ...
1
vote
2answers
2k views
How to locally monitor outgoing internet traffic?
I have a cable internet connection that goes to a ASA firewall and then into my local network where i have several machines including many VM's on a ESXI server.
I am looking for a way to monitor ...
2
votes
1answer
236 views
OWASP: Insufficient Logging & Monitoring - open source tools
Being new to the security and logging and after reading a lot about the terms used, I am pretty sure I neither need an IDS/IPS nor a WAF.
I am mostly interested in automating the "monitoring" of my ...
0
votes
1answer
310 views
What can schools see on school issued Mac? [closed]
My school gave everyone Macs that were sealed in the box and everything. From what I’ve seen so far, the root certificate hasn’t been tampered with. Can they see my https web history? Can laptops have ...
0
votes
1answer
1k views
Analyze / Sniff all packets from all devices connected to a router
First of all, before explaining what I'm trying to do, let me clarify that my intentions are not steal any information, as it's only for study purposes, not even for my own entertainment.
I'm trying ...
1
vote
2answers
57 views
Can a laptop be monitored when booted from external drive?
If a laptop is monitored (say from employer) and I boot it from an external USB hard drive or a LIVE-CD/USB-Stick, can it then still be monitored somehow?
1
vote
3answers
697 views
How can I capture all data from a specific device on my network?
I have an iPhone that is connected to my Wi-Fi at home. I want to capture ALL traffic from that iPhone (because it's my network) and record it and view it. I don't have physical access to the device.
...
2
votes
0answers
124 views
Monitoring and Securing IoT devices [closed]
I have a mix of IoT devices at home. Alexas, WiFi PLugs, Smartthings (with related Z-Wave/Zigbee devices). I've been on the hunt for a solution to monitor what these devices send out and secure data ...
1
vote
2answers
303 views
How should we mitigate threats that are keep coming to our security monitoring system?
We have continuous cybersecurity threat feeds that coming to our SOC on a daily basis from different sources that provide all the new CVEs, new malware variations and more. We just don't know how to ...
0
votes
1answer
141 views
How to check if my PC's HTTPS/TLS connection is monitored or a key-logger is installed? [duplicate]
A few days ago, in the office, we were asked by our bosses to install a program. This was supposed to be an Antivirus program.
But after installing this program many of our colleagues have been ...
3
votes
1answer
392 views
Avoiding Dark Web monitoring detection
At our company, we offer security services to our clients. One of the things that management has pushed down to us is the need for dark web monitoring.
Because I am in the business meetings as well, ...
3
votes
0answers
128 views
Commercially available spyware not getting detected
I guess everyone here knows those commercially available stealth PC monitoring software.
I'm surprised that those trojans are hardly detected by virus scanners.
All surveillance makers recommend in ...
1
vote
1answer
661 views
osquery in Docker environment
I am currently researching security monitoring in Docker environments and want to explore the possibility of using osquery to gather activity from containers, but I have run into a bit of a security ...
4
votes
1answer
2k views
How can disabling Diffie-Hellman cipher for packet inspection be secure?
I have noticed that a number of network packet monitoring tools on the market today seem to have roughly the same recommended configuration parameters as described below:
Disable Diffie Hellman in ...
3
votes
1answer
223 views
Methods for analysing android app on runtime [closed]
I want to analyse security of android app by monitoring its behaviour on runtime. I need to monitor variables modifications, accesses and api calls while android app is running on the device. I tried ...
2
votes
1answer
481 views
Security Onion VMWare + OpenWRT IPTables Mirroring
I'm trying to set up SO in my home network to lab and see if I can monitor all ingress/egress traffic from my SOHO router. I don't have a switch with SPAN ports, or a network tap so I'm using OpenWRT ...
2
votes
2answers
77 views
What is the best way to analyze results of a technical security assessment? [closed]
I want to conduct a technical security assessment on my company's client computers with focus on Windows 10.
So far, my idea is to execute several Powershell scripts on the clients and gather the ...
1
vote
0answers
193 views
Are there any good instant messaging applications with a good end-to-end encryption to its web application? [closed]
Whether an app like Telegram is secure or not has already been answered and it has recently been confirmed that it is not. Apps like Signal and Cryptocat have been recommended instead. But do these ...
-9
votes
1answer
265 views
Monitoring setup compromising online privacy [closed]
Original post has been updated and includes more details, hopefully it will be sufficient.
Background
I'm hoping that someone here has the adequate knowledge along with suggestions as to what can be ...
1
vote
1answer
215 views
How to get private keys for traffic decryption?
We are a huge organization with hundreds of web servers in a DMZ. We have appliances (a few of them in each location) where all incoming traffic from outside of the network is decrypted (well it ...
-3
votes
1answer
98 views
Tools for monitoring wifi? [closed]
is there any tools in linux for :
monitoring upload and download traffic
host ip and mac using (that is live)
device name
of all users who use our wifi or local network?
0
votes
1answer
2k views
What are the core differences between Airodump-ng, Wireshark, and TCPdump? [closed]
As all three tools are packet sniffers, I would have expected them to give me the same results when I use them to monitor my home's network, but they don't. Therefore what are the core differences and ...
5
votes
1answer
2k views
Where would I place a sniffer to capture data in a home network with the following topology?
I am aware of the various techniques that there are to sniff around a network that has Hubs or Switches (port mirroring, hubbing out, use of taps), but I am not sure which method would be more ...
2
votes
1answer
1k views
How does WiFi NIC monitoring mode work, if at all? [closed]
I always wondered, when connected to WIFI network, does my NIC receives packets directly from other computers (not ones that passed through the router) and ignores them (similarly to what happens when ...
0
votes
1answer
1k views
How to monitor a logs directory with OSSEC agent in windows
My problem is that I have some windows programs I want to monitor with the following structure in the logs filename:
Program name%Y%m%d_%timestamp.log
Where %timestamp is formed by the concatenation ...
10
votes
2answers
311 views
How is the security of SSH affected in the presence of a passively monitoring MITM?
In an ideal world, where all links are fully trustworthy from a data integrity point of view, with proper settings, modern SSH can be more or less assumed to be fully secure against eavesdropping on ...
2
votes
1answer
986 views
SIEM Alien Vault recommended method for muting noise
I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that ...
2
votes
1answer
637 views
Does Web proxy also get information of any files uploaded to cloud?
I want to detect any files uploaded from my computer to any website.
I was not able to find anything where I can directly detect any files uploaded from my computer to any website.
I hear that proxy ...
0
votes
1answer
619 views
tcpdump traffic to a remote host?
I unfortunately have to work with a publicly accessible 3rd party badwebsite.example.com where only the login form is served via HTTPS. The inbox, messenger, tickets queue - all go through HTTP. Is ...
2
votes
3answers
213 views
Is it possible to tell if an email went through a proxy type service where the email might be monitored?
Recently, we began implementing some 3rd party email proxy services that allow control filters for in and out bound emails. This is for compliance reasons.
Anyway, this got me thinking. Could it be ...
1
vote
0answers
2k views
Unknown device in home network
I have a home network that is behind NAT. My router IP address is 192.168.0.1 and DHCP is configured to provide addresses from the 192.168.0.1/24 range.
My desktop is connected trough the ethernet ...
