A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

0
votes
1answer
22 views

Directory Listing on WordPress

If a WorPress application that uses the Akismet wordpress plugin has certain directory listing exposed publicly, like, akismet-en_AU.po and the other .po files, and directories like plugins, themes, ...
1
vote
1answer
60 views

Teamviewer Security Question

Currently we are using Teamviewer 9. We have a couple of desktop machines that are locked down in the following manner: 1). The shell is no longer explorer.exe, it is a custom program we have ...
2
votes
2answers
46 views

Should I use a separate SQL Server instance for a database with PII?

We build software which needs a SQL SERVER database. This database will hold private user information (address,bank, ...) My question is: Should I install my database in a fresh SQL Server ...
0
votes
1answer
53 views

Can I use stormpath user management service with a XACML library like BALANA?

I'm trying to implement some security access control in a software I'm building. I came across Stormpath for user management and they have somewhat an approach for RBAC yet what I was considering is ...
26
votes
6answers
4k views

Is Linux really that secure, with only root password denying external access?

While I was searching online for information about Linux security, the most typical explanation was: Linux is secure, because the root password is required to access the kernel and install new ...
3
votes
1answer
56 views

Access rights management in large companies

I'm wondering how large companies with tens / hundred of applications are handling access-rights for their users. From what I've seen, it's a nightmare that never ends, and it requires full-time ...
0
votes
0answers
38 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
2
votes
1answer
77 views

MAC vs DAC vs RBAC

Someone can suggest me a real situation in which is better to use MAC (Mandatory Access Control) instead of DAC (Discretionary Access Control) or RBAC (Role Based Access Control)? And in which DAC is ...
4
votes
5answers
104 views

Can someone please explain RBAC to me?

From http://msdn.microsoft.com/en-us/library/jj709705.aspx In contrast to the DAC model, which is oriented around objects, the AzMan RBAC model attempts to orient the common administrative experience ...
0
votes
2answers
68 views

Securing apache by IP with .htaccess

I have a folder that I don't want to be accessible from outside my network's LAN. It seems like all traffic from the outside world goes through my firewall (192.168.1.39). So I made my .htaccess as ...
0
votes
1answer
88 views

is UPnP / NAT-PMP really necessary today?

The possibility to enable port forwards for any hosts inside the LAN has of course security implications. The problem from my point of view is not that there are bad users, but bad hosts/programs and ...
1
vote
2answers
40 views

Should application logs be available to admins or just superuser?

I'm developing a kind of standard web-application, to be hosted internally on few customer's servers (not a public service, startup or anything like that). A kind of CMS, e-learning platform or ...
0
votes
1answer
99 views

Is a firewall an access control list?

I want to know if a firewall is considered an access control list (ACL). I know there are other types of ACLs, but am specifically interested in knowing if a firewall is an ACL. Edit: It appears ...
1
vote
1answer
41 views

Is open-to-all CORS safe for non-cookie-based authentication schemes (e.g. OAuth)

I'm building an API with both protected and public endpoints, and I'm protecting it with OAuth 2's various flows. I want this API to be open to the world - the main consumer website won't even be on ...
0
votes
0answers
28 views

Bell-LaPadula implementing by using sets of roles

I have sets of roles defined hierarchically, i.e. role anonymous is a subset of role super-user. The roles are given tu users and also used in the ACL for marking who has access to a resource. ...
1
vote
1answer
72 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
21
votes
7answers
6k views

If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker? [closed]

In other words, how easy is it to break into Windows without having the passwords for any of the users configured in the computer?
2
votes
1answer
247 views

How can the Google web crawler bypass portals?

This is a situation that I have encountered on a number of occasions. I will conduct a web search in Google, a link to a file (.pdf for example) will take you to that file on the server. It opens up ...
0
votes
3answers
92 views

What security issues will I face with outsourced VPS server?

Our small comapny wants to launch a paid service, hosted on the outsourced VPS server. The obvious risk is that the machine is physically not in our office and that possibly the database could be ...
1
vote
1answer
58 views

what are security flaws on providing access to users through a unlisted/private/token/signed URL?

Some web applications enable registered users to grant temporal application access to un-registered users sending token/private/unlisted/signed URLs (I ignore the exact terminology for this), which ...
0
votes
0answers
87 views

Since when Access-Control-Allow-Credentials is required?

About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal ...
0
votes
3answers
48 views

Restrict access to admin area by checking SSH connections

Assuming that the users have dynamic IPs (so I can't whitelist) and that setting up a VPN is not an option, is it a valid approach to restrict access to an administration area by only allowing IPs ...
0
votes
2answers
38 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
-3
votes
1answer
186 views

How could an attacker have gained remote access to my laptop? [closed]

I have a 15 yr old daughter who's become not only a certified Microsoft Expert, but by pure accident, it came to my attention she'd long ago created a SPLIT network connection on our internet, HIDDEN ...
-1
votes
2answers
108 views

Is there a difference between Broken Access Control and Insecure Direct Object reference? [closed]

According to me,if this difference is correct,it is that for exploiting a broken access control you don't necessarily need to be logged into the application,but for exploiting insecure direct object ...
6
votes
2answers
547 views

What are best practices for implementing ACL

I have a website that has certain menu items that need to be hidden from end users. The web site has PHP in the front-end and Java and Spring in the back-end, deployed on a Linux OS in a VM ...
4
votes
2answers
325 views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
4
votes
2answers
690 views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
5
votes
3answers
94 views

Is SESAME really used in Europe?

I am looking at a text that mentions that the Secure European System for Applications in a Multi-vendor Environment (SESAME) was designed to address some of Kerberos weakness, with enhancements such ...
2
votes
0answers
708 views

Google ads and/or DoubleClick wants to access the keyboard API in Firefox? [closed]

I have started Firefox in an Ubuntu terminal, and now I see these messages during browsing: "No permission to use the keyboard API for http://googleads.g.doubleclick.net" I mean... WTF? Why does ...
1
vote
0answers
102 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
43
votes
5answers
3k views

How does a country block its citizens from accessing a site?

Following Turkey's recent social site blocks, I am wondering how can you efficiently accomplish that as a country. Similar for a big company. Blocking IPs → easy to circumvent, (proxys, tunnels, ...
2
votes
1answer
444 views

Looking for approach to implement attribute based access control (ABAC)

We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up: Will it lead to significant performance issues? Especially ...
0
votes
2answers
63 views

Anonymizing data for applications

I try to design a system which reads events comming from devices, stores them and exposes API to various applications. Originally I wanted to introduce a module Id translator, so I would store only ...
1
vote
4answers
162 views

Comprehensive audit of firewall - is Internet truly not accessible?

We have many Linux servers in several co-locations over the world. By design, these machines generally should not be able to access the Internet. Depending on location and role, some sites may have ...
0
votes
3answers
149 views

Is a console application with NT Authority/System rights dangerous?

A developer managed to open a console application with NT Authority/System rights at the startup screen before logging in. From that command prompt it is possible to execute arbitrary programs like ...
0
votes
1answer
154 views

Employee Snooping [closed]

I just got hired at this SW tech company with a few IT gurus in it. There is a clever genius that is suspect. He obtained my personal home email address I use. It was obtained from company ...
40
votes
9answers
7k views

Why am I allowed to access protected Windows files when I boot Ubuntu from USB?

How come I'm allowed to reboot a computer that I don't own, put in a USB, boot ubuntu from it and then access all files stored on the drives available (even critical files such as system files on C ...
1
vote
2answers
66 views

user roles or access levels

I am beginning a new project and I already know that I'll have various roles for various users, regardless of their access level. They just have different jobs to do. With that in mind, I'm thinking ...
2
votes
2answers
99 views

RBAC and assertions, which authorization flow is better?

I'd like to ask which authorization flow is considered better or standard. First approach (has role AND assertion is valid): if (!isGranted(roles, permission) { return false; } if ...
1
vote
1answer
147 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
-1
votes
4answers
221 views

what will happen if us government shutdown Tier-1 internet backbone?

what will happen if us government shutdown Tier-1 internet backbone? Although Internet is designed to be quite resilient: Internet BackBone The Internet, and consequently its backbone networks, ...
1
vote
3answers
156 views

Resetting passwords howto

I am currently in the process of designing a registration form for the users to register accounts. The accounts will contain a lot of personal information, so I want to ensure highest possible ...
4
votes
6answers
700 views

Locking IP addresses to try and improve security

(Originally posted on the work place and was suggested to post here) I know being an employee I am paid to do what my boss tells me to do, however: I am currently writing a website for my company ...
1
vote
1answer
78 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
0
votes
1answer
100 views

Difference between password expiration and account expiration [closed]

If a password expires, the user can't access the account. If the account expires, the user can't access the account... So, what's the difference? Just that in the case of an expired account, I'd need ...
0
votes
1answer
597 views

Protecting MYSQL with Fail2Ban? [closed]

I have a bunch Raspberry Pis collecting data from behind client firewalls. I want to start sending this data to MYSQL server. Because the Raspberry Pis do not have static IP addresses, I obviously ...
2
votes
1answer
325 views

Security implications of granting IIS user group folder modify permissions

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group. What are the security implications of granting AppPoolIdentity modify and create ...
1
vote
1answer
151 views

Is a separate server needed for remotely accesing accounting software?

Wishing you all a great 2014. I hope this is the right section. Basically we have a Dell Poweredge R520 server in our office, and we now want to install some accounting software that can be accessed ...
2
votes
1answer
70 views

Preventing softwares from leaving traces in Windows | deleting the traces easily

Say I open a .doc file from my UFD. I want to avoid leaving any traces in Windows (e.g. recent files, back-up files, swaps, etc) , or at least be able to delete all easily. So in this case, I want to ...