A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

0
votes
1answer
68 views

Windows Sever Access Control [on hold]

Windows server manages access control through DAC and MAC. What can be the possible reasons for using DAC and MAC and not using RBAC?
1
vote
1answer
42 views

Is it safe to store important data in an encrypted access token?

Is it safe to store important data in an encrypted access token? For example, instead of storing access tokens in a database, not storing them at all and putting their associated data into them before ...
3
votes
1answer
36 views

Enabling Unsigned ActiveX

A third-party wants to provide a web app which they say only works if we enable unsigned ActiveX (unfortunately users are required to use IE). I understand what 'signing' is, as well as the basic ...
2
votes
2answers
83 views

How risky is having sensitive files on webroot?

I understand that having anything sensitive under webroot is not smart; someone may be able to access it via url. However, I do not have a choice with my web host (iPage) as they limit my server space ...
1
vote
2answers
107 views

Contactless session on ATM?

I'm currently reading about an access control and saw something interesting about smartcard contact & contactless. From what I understood from the book, smartcard contact is like an ATM Card. ...
0
votes
1answer
25 views

Directory Listing on WordPress

If a WorPress application that uses the Akismet wordpress plugin has certain directory listing exposed publicly, like, akismet-en_AU.po and the other .po files, and directories like plugins, themes, ...
1
vote
2answers
116 views

Teamviewer Security Question

Currently we are using Teamviewer 9. We have a couple of desktop machines that are locked down in the following manner: 1). The shell is no longer explorer.exe, it is a custom program we have ...
2
votes
2answers
64 views

Should I use a separate SQL Server instance for a database with PII?

We build software which needs a SQL SERVER database. This database will hold private user information (address,bank, ...) My question is: Should I install my database in a fresh SQL Server ...
0
votes
2answers
86 views

Can I use stormpath user management service with a XACML library like BALANA?

I'm trying to implement some security access control in a software I'm building. I came across Stormpath for user management and they have somewhat an approach for RBAC yet what I was considering is ...
27
votes
6answers
4k views

Is Linux really that secure, with only root password denying external access?

While I was searching online for information about Linux security, the most typical explanation was: Linux is secure, because the root password is required to access the kernel and install new ...
3
votes
1answer
69 views

Access rights management in large companies

I'm wondering how large companies with tens / hundred of applications are handling access-rights for their users. From what I've seen, it's a nightmare that never ends, and it requires full-time ...
0
votes
0answers
39 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
2
votes
1answer
401 views

MAC vs DAC vs RBAC

Someone can suggest me a real situation in which is better to use MAC (Mandatory Access Control) instead of DAC (Discretionary Access Control) or RBAC (Role Based Access Control)? And in which DAC is ...
4
votes
5answers
128 views

Can someone please explain RBAC to me?

From http://msdn.microsoft.com/en-us/library/jj709705.aspx In contrast to the DAC model, which is oriented around objects, the AzMan RBAC model attempts to orient the common administrative experience ...
0
votes
3answers
120 views

Securing apache by IP with .htaccess

I have a folder that I don't want to be accessible from outside my network's LAN. It seems like all traffic from the outside world goes through my firewall (192.168.1.39). So I made my .htaccess as ...
0
votes
1answer
147 views

is UPnP / NAT-PMP really necessary today?

The possibility to enable port forwards for any hosts inside the LAN has of course security implications. The problem from my point of view is not that there are bad users, but bad hosts/programs and ...
1
vote
2answers
42 views

Should application logs be available to admins or just superuser?

I'm developing a kind of standard web-application, to be hosted internally on few customer's servers (not a public service, startup or anything like that). A kind of CMS, e-learning platform or ...
0
votes
1answer
120 views

Is a firewall an access control list?

I want to know if a firewall is considered an access control list (ACL). I know there are other types of ACLs, but am specifically interested in knowing if a firewall is an ACL. Edit: It appears ...
1
vote
1answer
53 views

Is open-to-all CORS safe for non-cookie-based authentication schemes (e.g. OAuth)

I'm building an API with both protected and public endpoints, and I'm protecting it with OAuth 2's various flows. I want this API to be open to the world - the main consumer website won't even be on ...
0
votes
0answers
36 views

Bell-LaPadula implementing by using sets of roles

I have sets of roles defined hierarchically, i.e. role anonymous is a subset of role super-user. The roles are given tu users and also used in the ACL for marking who has access to a resource. ...
0
votes
2answers
62 views

How many accounts should I have in an information system?

Is it a problem to have more than one account in an information system from security point of view? Let me clarify a bit. It is a bank system. I wonder if having a CSO (customer service officer) ...
1
vote
1answer
129 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
21
votes
7answers
7k views

If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker? [closed]

In other words, how easy is it to break into Windows without having the passwords for any of the users configured in the computer?
2
votes
1answer
293 views

How can the Google web crawler bypass portals?

This is a situation that I have encountered on a number of occasions. I will conduct a web search in Google, a link to a file (.pdf for example) will take you to that file on the server. It opens up ...
4
votes
1answer
113 views

Car Remote App Security

Car manufactures like BMW, Audi or Mercedes-Benz all provide mobile applications to control your car. All apps share really critical functions like remote lock/unlock or the ability to find your car ...
0
votes
3answers
123 views

What security issues will I face with outsourced VPS server?

Our small comapny wants to launch a paid service, hosted on the outsourced VPS server. The obvious risk is that the machine is physically not in our office and that possibly the database could be ...
1
vote
1answer
61 views

what are security flaws on providing access to users through a unlisted/private/token/signed URL?

Some web applications enable registered users to grant temporal application access to un-registered users sending token/private/unlisted/signed URLs (I ignore the exact terminology for this), which ...
0
votes
0answers
156 views

Since when Access-Control-Allow-Credentials is required?

About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal ...
0
votes
3answers
50 views

Restrict access to admin area by checking SSH connections

Assuming that the users have dynamic IPs (so I can't whitelist) and that setting up a VPN is not an option, is it a valid approach to restrict access to an administration area by only allowing IPs ...
0
votes
2answers
49 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
-3
votes
1answer
206 views

How could an attacker have gained remote access to my laptop? [closed]

I have a 15 yr old daughter who's become not only a certified Microsoft Expert, but by pure accident, it came to my attention she'd long ago created a SPLIT network connection on our internet, HIDDEN ...
-1
votes
2answers
155 views

Is there a difference between Broken Access Control and Insecure Direct Object reference? [closed]

According to me,if this difference is correct,it is that for exploiting a broken access control you don't necessarily need to be logged into the application,but for exploiting insecure direct object ...
6
votes
2answers
833 views

What are best practices for implementing ACL

I have a website that has certain menu items that need to be hidden from end users. The web site has PHP in the front-end and Java and Spring in the back-end, deployed on a Linux OS in a VM ...
4
votes
2answers
504 views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
4
votes
2answers
1k views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
5
votes
3answers
114 views

Is SESAME really used in Europe?

I am looking at a text that mentions that the Secure European System for Applications in a Multi-vendor Environment (SESAME) was designed to address some of Kerberos weakness, with enhancements such ...
2
votes
0answers
739 views

Google ads and/or DoubleClick wants to access the keyboard API in Firefox? [closed]

I have started Firefox in an Ubuntu terminal, and now I see these messages during browsing: "No permission to use the keyboard API for http://googleads.g.doubleclick.net" I mean... WTF? Why does ...
2
votes
0answers
124 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
43
votes
5answers
4k views

How does a country block its citizens from accessing a site?

Following Turkey's recent social site blocks, I am wondering how can you efficiently accomplish that as a country. Similar for a big company. Blocking IPs → easy to circumvent, (proxys, tunnels, ...
3
votes
1answer
657 views

Looking for approach to implement attribute based access control (ABAC)

We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up: Will it lead to significant performance issues? Especially ...
0
votes
2answers
71 views

Anonymizing data for applications

I try to design a system which reads events comming from devices, stores them and exposes API to various applications. Originally I wanted to introduce a module Id translator, so I would store only ...
1
vote
4answers
175 views

Comprehensive audit of firewall - is Internet truly not accessible?

We have many Linux servers in several co-locations over the world. By design, these machines generally should not be able to access the Internet. Depending on location and role, some sites may have ...
0
votes
3answers
198 views

Is a console application with NT Authority/System rights dangerous?

A developer managed to open a console application with NT Authority/System rights at the startup screen before logging in. From that command prompt it is possible to execute arbitrary programs like ...
0
votes
1answer
163 views

Employee Snooping [closed]

I just got hired at this SW tech company with a few IT gurus in it. There is a clever genius that is suspect. He obtained my personal home email address I use. It was obtained from company ...
40
votes
8answers
7k views

Why am I allowed to access protected Windows files when I boot Ubuntu from USB?

How come I'm allowed to reboot a computer that I don't own, put in a USB, boot ubuntu from it and then access all files stored on the drives available (even critical files such as system files on C ...
1
vote
2answers
68 views

user roles or access levels

I am beginning a new project and I already know that I'll have various roles for various users, regardless of their access level. They just have different jobs to do. With that in mind, I'm thinking ...
2
votes
2answers
101 views

RBAC and assertions, which authorization flow is better?

I'd like to ask which authorization flow is considered better or standard. First approach (has role AND assertion is valid): if (!isGranted(roles, permission) { return false; } if ...
1
vote
1answer
252 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
-1
votes
4answers
294 views

what will happen if us government shutdown Tier-1 internet backbone?

what will happen if us government shutdown Tier-1 internet backbone? Although Internet is designed to be quite resilient: Internet BackBone The Internet, and consequently its backbone networks, ...
1
vote
3answers
170 views

Resetting passwords howto

I am currently in the process of designing a registration form for the users to register accounts. The accounts will contain a lot of personal information, so I want to ensure highest possible ...