Remote-support session logs must leave the appliance to survive a rebuild, experts say

·11 views

Remote-support sessions are recorded mainly to document changes made during maintenance, but appliance-local logs sit on an encrypted partition and are not centralised unless forwarding is configured. CISA advises forwarding appliance syslog and session events to a SIEM immediately, along with web application firewall, reverse proxy and perimeter firewall logs covering the exposure window. The article stresses that usable records must leave the appliance, be time-synchronised with other systems, and be retained beyond the appliance's lifecycle. It also highlights that missing sessions can signal altered logging, not just inactivity. Mandiant warns that intervals between intrusion and discovery in the BeyondTrust case were measured in weeks, and additional organisations may have been compromised before disclosure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Wrong CSV Headers Cause Stock Photo Uploads to Be Rejected Before Review

A contributor to stock asset marketplaces found that batches of files were bounced within a minute because of errors in their CSV metadata headers, before any content review occurred. Platforms including Adobe Stock, Vecteezy, and Dreamstime run an automated check that verifies column count and order, and each requires a different number of columns: five for Adobe Stock, four for Vecteezy, and fifteen for Dreamstime. Common errors such as trailing commas, incorrect keyword separators, and mismatched filename extensions can cause the entire batch to fail. The contributor responded by writing a Python script that generates the correct header for each platform and a separate tracker to prevent duplicate submissions, which can trigger account flags.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ZoomEye Finds Over 5 Million Internet-Reachable Elasticsearch Services on Port 9200

A ZoomEye search for port 9200, the default HTTP interface of Elasticsearch, returned 5,079,738 matches as of 2026-09-24. The analysis notes that Elasticsearch often underpins log pipelines and internal search, where sensitive data such as credentials and personal information can be indexed. Older Elasticsearch defaults left security features unconfigured, and such deployments persist in environments built earlier or copied from outdated documentation. The article cautions that the count reflects scale rather than confirmed vulnerability, since other services also use high ports. It recommends restricting network access, enabling authentication and transport layer security, and ensuring inter-node transport ports are never exposed to the internet.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Communications Deserve Their Own Service in Larger Applications

Most applications send notifications such as order confirmations, password resets, and shipping updates, usually starting with a simple email client call. For small systems this approach is often sufficient, but larger applications with separate business contexts need more deliberate design. Microsoft's .NET eShop reference application, split into Ordering, Identity, and Payment services that communicate through contracts, is used as the example. A new series adds a dedicated communications service to eShop, starting with an analysis of where that service's boundary should lie. The article argues that a message often needs data spanning several bounded contexts, so no single existing service naturally owns it.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A public web page reveals 20 test case categories before any automation begins

The article argues that a public page already exposes many testable traits, such as HTTPS support, links, form labels, headers, and load time, before any test code is written. It presents a list of 20 test categories, including functional, accessibility, security, performance, and privacy checks, each illustrated with a sample case ID. The author recommends reading the public response first and following visible same-host links a couple of levels deep. Only the test kinds a team will actually run should be kept, and each case should be paired with a named tool such as Playwright, axe-core, or Lighthouse. The piece cautions that missing security headers are signals for the owner to examine rather than proof of a breach, and that reading a public page is not a penetration test or a substitute for plans covering logged-in or high-traffic systems.

0 comments Read more at DEV Community