Hot answers tagged

427

Is this normal for a pentest? Absolutely not. Best case scenario: they are performing "social engineering" penetration testing and want to see if you can be pressured into fulfilling a very dangerous action. Middle-case scenario, they don't know how to do their job. Worst-case scenario they are only pretending to be an auditing company and fulfilling ...


115

Here's one data point from a software company that has an interest in security. I know this is common in similar organisations. There is a number of networks. They are physically separated and airgapped, run different colour-coded network cables. Each employee has an 'administration' machine, which can connect to the Internet (via a proxy) for doing email ...


112

How should I proceed? Don't proceed with them. The way they act is unprofessional. Pentests carry risks for both parties, and it doesn't seem they did anything to address them. First, you should absolutely not hand anything over without a written contract (including an NDA). It's surprising they routinely do business like that. How do they know the exact ...


71

In my experience, it is common for developers to have admin access on their own machines. It is also common for them not to have admin access on their own machines. However, in the latter situation some accommodation is generally made so they can get their jobs done without too much friction. One very common accommodation is access to a Hypervisor on the ...


53

The request for this information may not only be for a security audit, but also a process audit, and it sounds like it might be well founded, since: If you wanted to break into their portion of this system, you come after me. What would happen if you were "hit by a truck" tomorrow? If you are the only one that knows the systems, your clients and theirs ...


50

The main and almost unique reason why most software in the Linux ecosystem is written in C is Tradition. Developers see software written in C, libraries with a C-based API, and thus they use C, because that's convenient. Compilers are already there, and work well because the whole OS is written in C. None of this says that C is good for developing robust ...


48

However, one of my colleagues disagrees and considers such to be an attack on the Integrity principle, because data was modified by being destroyed without authorization. Your colleague has a point. Unauthorized data deletion is foremost a breach of integrity since deletion can be considered a special case of modification. This can have an impact on ...


47

I work for a fairly large investment management firm (~6000 employees) and developers are one of the groups that we approve for local admin access. We tell them not to install any software, as that is handled by local desktop/software compliance. We also have a Developers AD Group that allows members to change the execution policy on their machines without ...


41

Auditd is an extraordinarily powerful monitoring tool. As anyone who has ever looked at it can attest, usability is the primary weakness. Setting up something like auditd requires a lot of pretty in-depth thought about exactly what it is that needs auditing on the specific system in question. In the question you decided on a web server as our example system,...


40

Confidentiality is generally a privacy concern. It's just a more general term. It's like saying animal instead of dog. In addition to the definitions, you can confirm that by searching for synonyms of privacy and synonyms of confidentiality. You can use confidentiality instead of privacy, but not the opposite.


38

Prior to any penetration test there should be a Scoping and Rules of Engagement document(s) that is signed by both parties. These documents should describe in detail what will be tested and what methods have been agreed upon by your company and the contractor. If you have not gone through this discussion with your contractor, discontinue the engagement and ...


33

DNS test - many packet sniffing tools perform IP address to name lookups to provide DNS names in place of IP addresses. To test this, you must place your network card into promiscuous mode and sends packets out onto the network aimed to bogus hosts. If any name lookups from the bogus hosts are seen, a sniffer might be in action on the host performing the ...


31

In my career, with rather small companies (less than 100 people), we always had local admin rights. We either have real desktop machines which are maintained by IT, but got the rights, or we were allowed to have virtual machines of all sorts that we completely managed by our own. If we had not local admin access, we would try all sorts of bad "solutions" ...


30

PCI DSS sections 6, 7, and 8 all bear on this question. For example, part of 6.3.2 which requires code review: Code changes are reviewed by individuals other than the originating code author, and by individuals knowledgeable about code-review techniques and secure coding practices. 6.4 with change control: A separation of duties between ...


30

You said "Very little of this stuff is actual legal requirement" but depending on which government this concerns, this may be a very strict legal requirement. If that government requires their departments/agencies to follow NIST SP800-53 then they can't just answer "we have a guy." The answers to these security controls require detailed information giving ...


29

In a rather small department of a larger organization (~100 in department, ~3500 in full organization) we chose an in the middle solution: sysadmins had 2 accounts, one (non administrator even for the local machine) that was used for non administative tasks (mail, document edition, etc.) and one with AD administrator priviledges that was supposed to be only ...


27

In a formal review of an application's security, all libraries should be vetted for security defects. However, this is not the point of OWASP-2013 A9. The core of OWASP-2013 A9 is about having a policies in place to ensure that an application isn't compromised due to negligence. OWASP states the following: Identify all components and the versions you ...


26

In my experience allowing and disallowing local admin access is common, just as common as dirty workarounds for the latter. - So you should ask yourself: Which threat to your network is made worse by local admin rights? To which the answer shoud be: NONE - The access to resources in your network should be restricted on a per user basis, completely ...


25

@vp gave the theory, I will give some tools. For use in Linux systems: SniffDet: This one employs 4 different tests: ICMP test, ARP test; DNS test and also a LATENCY test (which VP01 didn't mention). The tool is recently updated and I recommend it. Also: nmap: There is an NSE script for nmap called sniffer-detect.nse which does just that. nast: It ...


25

There's a couple of ways that I've seen this done, each has it's pros and cons. As noted by @RoryAlsop below a common point for both approaches is that the executive summary should, as much as possible, be written for a business audience (assuming that it's a test you're doing for a 3rd party or the report will be passed to management). Reporting by ...


25

You can write secure code in C. Its just that the language is unsafe by default. The safety has to be tacked on manually with extra code (which of course can itself contain bugs). For that reason, C was never really the best choice for security-critical software. It was used anyway in FOSS because free compilers for it have historically been available on ...


25

NEVER EVER!! We are doing a full pentest at my work. It was explicitly stated by the pentesters that they don't even need the login/password for anything. We stated that it was great since we'd never release anything to them before hand. There are 3 main types of pentests: white box, grey box, black box. White Box is that you give them all information ...


20

Microsoft's guidelines for Security Development Life-cycle (SDL) for Agile recommends security practices during design, implementation, and release of the project. Regardless of the development methodology in use, no line of code should make it into production until it has undergone a security review. If financial constraints are preventing this level of ...


20

My company is currently engaged in a security audit framed as a pentest. and Note, we've never signed a single NDA or other contract with them yet, and I'm very reluctant to provide this info to them because of this. The use of "engaged" in this context implies a definition of "enter into a contract to do something." This leaves me wondering if the ...


19

Firstly, CIA (confidentiality, integrity, and availability) are not comprehensive goals for information security. Other principles like privacy and non-repudiation don't fit cleanly into this famous triad. ISO/IEC 27000:2009 defines information security as: "Preservation of confidentiality, integrity and availability of information. Note: In addition, ...


18

Generally one has to know what TPMs and TXT and all these technologies are aimed to protect from, because there are misunderstandings. TPMs, generally, enable 5 distinct processes, and only those: Integrity measurement – computation of a cryptographic hash of a platform component Authenticated boot – a process by which a platform's state (the sum of its ...


18

I think you seek the use of a packet generator and a corresponding number of systems generating packets to match the load you seek. Use random valid IP addresses for the packet source addresses and you should find yourself quite annoyed when it comes time to filter. You can do all of that without ever sending a bit across your ISP's link. If you get DDOS'd ...


18

To a not-insignificant degree, this is (as you mentioned) a trust issue, not a technical one. We try to be careful to as far as we can, hire trustworthy people who won't abuse their positions. That said, there are a number of controls that can be implemented to either limit unauthorized access, and/or verify that the trust in individuals is well-placed ...


18

Given the current state of public cloud, I would argue that in many cases it is in fact more secure than on-premise storage. Granted I work for Microsoft, but my opinion both pre-dates my employment, and extends to competitors like Amazon and Google as well. Companies whose business models are built on data center operational expertise and excellence, are ...


18

Linux Mint was compromised and a backdoored ISO was deployed, Ubuntu was compromised, the entire Linux Kernel was compromised before, as were others (Debian, FreeBSD, etc). Developers protect code through checks and balances in what code is accepted into the mainline source code repository, and checksums. The issues revolve around whether or not an attacker ...


Only top voted, non community-wiki answers of a minimum length are eligible