I am in the process of creating a rock solid secure image upload system for a website I am working on.

Naturally, I want to do client side checks to validate the image file (jpg or png), before I upload it for further checks to the server (using php) - and I assume for that I will use Javascript.

I know there is quite a lot to take into consideration here, so I'm taking it one step at a time.

My question is this, SHOULD I be using jquery for the client side image verification or vanilla javascript.

I know jquery is just javascript ultimately, but I have a propensity to do this with vanilla javascript. Personally I think vanilla javascript 'reads' better as code than jquery. I would also assume it's actually faster at execution.

Online, there is almost no useful information about vanilla javascript with regards to secure image file validation (there are snippets here and there I know) - but there is lots of information about jquery. I am the sort of person who likes to do things 'raw'. So that I can understand fully what my code is doing without any wrapper.

Am I missing something? Is jquery really great at something I'm not understanding? I see jquery code, and the equivalent javascript code, and don't really understand why people are so 'into' jquery. The code lengths are generally similar, and am personally not afraid of coding a bit more if that's what it takes.

I think part of it might be that jquery is all over the internet, and vanilla …

If we have a need to retain (can be in zipped/gz format) bsm
(Solaris Basic Security Module), what's the sizing of the partitions
recommended?

I know it depends on the amount of activity but suppose I
currently have 2GB left, how much more to extend?

BSM is merged with auditd logs

Exchange 2010 local server where to look for blocked emails and resolve

We use Symantec email security which filters all our email, once in awhile it blocks an email that it should not have blocked so I log into the portal and allow it
Issue: I have one user the recipient here in our company that cannot receive from one specific user from a diff company.
everyone else here in our company can send and receive to this user just fine
Example:
anyuser@ourcompany.com can receive from userA@theothercompany.com
Excluding: userB@ourcompany.com from userA@theothercompany.com

when I look into Symantec's email security portal it shows userA@theothercompany.com cannot be delivered because sender was denied our recipient server (This is our Exchange server) where on Exchange to I resolve this?

Dear experts,
We have done a penetration test and one of the oracle servers had a vulnerability which through it the penetration test experts manage to get the hash of the Domain admin users and then get the NTDS database of the entire AD Users.

How is it possible to check the current hash being utilized and to strengthen this on Active Directory servers? The currently installed servers are Windows 2016.

I would appreciate your recommendations.

Thank you

We're getting Nessus Tenable for vulnerability scans (likely with admin-credentialed scans)
& likely penetration tests.

Q1:
https://security.stackexchange.com/questions/71389/where-to-place-a-vulnerability-scanner-within-a-data-center
Above link has various views & I don't understand one of the line:
"If you're not granting the scanner admin level access to your assets and you're allowing an IPS to interfere then you're doing yourself a disservice."

Q2:
I intend to scan through the Network IPS because we may not be able to apply patches
in time (can't test out patches & obtain downtime in time), so most likely we'll deploy
NIPS virtual patches as interim remediation.  So do we still scan using 'admin credential'
scan in my scenario?

Q3:
Certainly dont plan to scan from public Internet but where is the best location within
our Prod network should we connect up this virtual (runs in VM) scanner?  Management
VLAN or in each Prod subnet, we place one scanner or run from laptop & connect to
a switch port which is assigned all the VLANs  or we just place in DMZ  or  internal
subnet & open up firewall rules?  Firewall may slow down the scans.

Q4:
From secure perspective, which is the most secure place to connect it as we may
use admin credentials (at this moment, no idea how to get it to integrate with
TPAM though we may move to CyberArk in 12-16 months' time as Nessus told
us it integrates with Cyberark, querying the password from Cyberark)

Hi,

I am auditing a large file server using Netwrix. The goal is to audit all files modifications like changed, deleted, added and credential or owner change.

For some share folder, i also want to audit List folder / read data. Until now, I know what to do.

List Folder / read data generates a lot of entries in the Security events log, this is why I don't enable it on all shares.

Netwrix use an agent scan all the files and create a state-in-time report of the files and folders permissions in time. So, that process is accessing millions of files and generating millions of audit events.

I am receiving a lots of events 4663 even in folder that I haven't enable Liste folder / read data. I am trying to find a way to eliminate those events to extend the security log retention.

The maximum size of the security log is 4GB and some audit plans in Netwrix doesn't have enough time to catch all the events before they are getting remove because it is getting full.

The solution, it is lower the number of audited events.

The following screenshot shows my auditing settings. LCDomainUsers is a Local Domain Group that contains Domain Users from 2 domains (forest).

The next screenshot shows a generated audit event. Note that SRVSHARE1$ is the computer name and it is not part of the group LCDomainUsers. I don't understand why this event is generated. The process name NwxFsAgent.exe is the Netwrix agent.

I am asking the …

I got a new Lenovo laptop running Windows 10 and iTunes 12.  I am running Outlook from Office 365, and have iTunes set to use Outlook for syncing Contacts and Calendar.  But when I synced my iPhone 6 to iTunes through the computer it wiped out all my existing Calendar and Contact data, although Outlook on the computer has all the information.  I tried using the "Replace Contacts and Calendar" option, but that didn't accomplish anything.  Please help.

Thanks,

Phil

Hello experts

I have a customer who is asking me if they can automate  and O365 ATP reports .
He want to receive the reports by mail for the Security Team instead of going to the Portal to get the reports

Is there any possibility?

Rgds

We are undergoing a Security Audit of our internal computer systems by an external 3rd party auditor.
We just rolled out new Windows 10 PCs to 75% of our staff and everything is working great.
We use Ivanti for patch management and all PCs are fully patched with all Windows updates and application security patches.
My question is:
What benefit , security wise, is there in ensuring that Service Packs are all completely up to date?
i.e. Does Windows 10 Service Pack 1909 contain more security patches or benefits if all individual Windows updates and security patches are already up to date?
I'd rather not install the Service Pack since all is working fine.

Thanks!

I went to extensions ( not add-ons) in Google settings and also to my control panel and programs. I saw nothing to identify these lower right hand corner popup ads. I used Malwarebytes and it found nothing and Trend micro finds nothing, I cleared all chrome data. These ads were x rated and now not so.
Within the ad you see: Google Chrome - www.heavy-r.com.
Is there a setting in Chrome to stop these or should I remove Chrome? I do see a option in the settings to restore Chrome to the default.
This started early yesterday and never before. When they pop up which is every 5-10 minutes, if I ignore them they close. When they re-appear an annoying sound.
Close does nothing and open just opens another window to some site,
Thanks.

Hello,

When trying to install a Windows application using Clickonce technology, I receive the following error message in detail section of failed installation:

"Deployment and application do not have matching security zones"

How do I fix this error?

Victor

I have a Certificate that I am trying to install on IIS Windows Server 2012 R2. The certificate file is a CRT.
I have tried a number of methods including:

• Convert the CRT to CER on the server I want to install on.
• Choosing "Complete certificate request" on the IIS / Server Certificates dialog.
• Select the CER file, and  choose
• Web Hosting
• for the store.

This ultimately give me a "Failed to remove certificate" message.

If I choose "Personal" for the store, it will import, but then the certificate does not show in the list for binding to the web site.

I have Googled a lot of posts regarding this, but have not been able to resolve this issue.

I am hoping  to get some advice to be able to install this cert properly.

how to block phpmyadmin page to be accessible from external ip