A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

2
votes
0answers
23 views

Is FAR (False Accept Rate) a property of algorithm or a property of the system?

As known in biometrics: https://en.wikipedia.org/wiki/Biometrics#Performance False match rate (FMR, also called FAR = False Accept Rate): the probability that the system incorrectly matches the ...
1
vote
0answers
38 views

Certificate based Access Control for Pub Sub messaging

I'm extending an existing p2p/master Pub Sub framework to support additional security measures, via over the wire encryption and topic based access control. I'd like to use the x.509 certificates that ...
0
votes
2answers
87 views

How secure is Windows 10 account control?

I have a Microsoft account in my machine (Admin). I set a guest account (Standard) for a friend so he can play games. Is there any way he could access my files/folders info? I mean, get data, view ...
2
votes
1answer
33 views
+50

What is the definition for different access attributes in object access auditing?

Though there is documentation available about configuring Object Access auditing, there is no place where I have found any documents explaining the different attributes in Object Access Auditing. Can ...
-2
votes
1answer
30 views

How to protect EXIF data against editing/deleting in jpeg file?

Is there any option to protect EXIF data against editing or provide password protection? I came accross the idea of creating executable file from image file, so that someone can view image the way is ...
-2
votes
2answers
51 views

Limit possible harm of ransomware on a fileserver

First to say: I know I need a backup and I have one of course but my question isn't about the safety of the data but about how to reduce the possible time that is needed to restore data. I'm already ...
0
votes
0answers
25 views

bundling session information in a binary

We are in the process of developing a desktop app. When a user is logged into the website we create a dynamic binary(.exe) and add session information to that binary which is valid for one time login. ...
1
vote
1answer
48 views

Implement RBAC for my application

I'm beginning to work on a new web app for which I require implementing Role-Based Access Control. I've identified three Roles for my application which will be Role 1, Role 2 and an Role 3. Each user ...
1
vote
2answers
38 views

Packet Filter vs Application proxy

http://postimg.org/image/b1w3bujnv/ I don't understand the highlighted part in red. Firstly,Why is a packet filter is enough in a situation where traffic is busy? Secondly,Isn't application proxy ...
0
votes
1answer
18 views

Application proxy structure & funtions

http://postimg.org/image/76newirnv/ For application proxy, Firstly, what does it mean "A proxy is something that acts on your behalf"? Can anyone give a more detail explanation about proxy? I read ...
0
votes
2answers
47 views

Stateful Packet Filter structure

http://postimg.org/image/o1ojanqq3/ For stateful packet filter, Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter? Secondly, how can stateful ...
0
votes
1answer
41 views

Packet Filter with Access Control List

http://i66.tinypic.com/29p50zp.png Can anyone explain how to read and understand row 1,2 and 3? My understanding for row 1 is : If any inside packets want to go to outside via any source port to ...
3
votes
0answers
37 views

Protocols for transfering access control data

The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and ...
4
votes
2answers
97 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
1
vote
0answers
41 views

iOS keychain - who or what can access it

I have an iOS app that needs to be able to upload data in the background, and so also when the device is locked. To achieve background uploading I use information stored in the key chain. Therefore I ...
4
votes
1answer
40 views

What are best practices for secure admin access management to critical 3rd party cloud application in big companies?

I've always wondered how can we manage admin access to critical 3rd party resources (social media, SaaS CRM, etc) in big companies to mitigate: The administrator might leave the company without ...
3
votes
0answers
91 views

Work wants to create an admin account on my system that I don't have access to? [closed]

This is on a Windows 10 system, and they want to create an administrator account that only my manager will have the password to. This is apparently to enforce some new "security policies" that haven't ...
1
vote
1answer
43 views

Defense-In-Depth With Common Security Controls

Many operating systems implement system capabilities, Posix access controls (DAC/ACLs) and mandatory access controls (SELinux), each using different underlying security controls to provide individual ...
0
votes
0answers
40 views

idevicerestore installation trouble

Can anyone help me figure out what im doing wrong to install this software? ``` root@kali:~/libimobiledevice# sudo apt-get install libusbmuxd-dev libplist-dev libplist++ Reading package lists... Done ...
1
vote
1answer
18 views

What are the tools/frameworks/techniques for authorizing a device accessing a web app?

I've a password protected web application (ASP.NET 4.5), and a requirement that when a registered user accesses the site from a device for the first time, I should authorize that access by sending an ...
-1
votes
1answer
55 views

Is Linux protection mechanism implemented using capability lists?

I often get confused whether a particular protection mechanism is ACL or CL by definition. As an example to clarify this, I would like to consider the case of Linux. I believe Linux uses capability ...
1
vote
1answer
178 views

Authorization on complex ownership

I have problem with object ownership in my web application. In my web application. There are object types: 1. Faculty 2. Student 3. Student Group 4. Student Lesson The following user roles are ...
3
votes
2answers
55 views

Is ignoring share permissions ok?

For my small home network I've found that it is easiest to setup network shares with share permissions set to Everyone: Full Control share permission and then configure the NTFS permissions according ...
0
votes
0answers
13 views

Implementation of security policy using BLP

I'm studying for an exam that covers BLP (Bell-Lapadula) and I was wondering if the following could be represented using this policy. All the examples I've found online are of a simple hierarchical ...
1
vote
0answers
35 views

Why doesn't homebrew fix file access problems by itself?

Before I took ownership of /usr/local, "brew link" caused a "/usr/local/..." not writeable. Is there any particular security reason why the program didn't say something like "The operating system won'...
3
votes
2answers
52 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
3
votes
1answer
98 views

User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database

I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access. I need to understand how I ...
5
votes
2answers
78 views

How to secure shared user on build server?

We have a CI server which is installed as the builduser and all tasks are executed as that respective user at the OS level. We have many teams sharing the build server which means the build user and ...
5
votes
1answer
468 views

Storing a password securely as part of a webservice

Say I'm creating a public web service which needs to write files to a Dropbox account (just an example). It needs to write files to one central account, not one per user. This service needs to access ...
4
votes
1answer
59 views

Are Linux System Capabilities Considered Mandatory Access Controls?

DAC is not mandatory because access permissions are left up to the resource owner's discretion. Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a process/...
4
votes
2answers
91 views

Using a single application for user and admin (with different auth methods) vs separating them into two applications

I am creating a human resource management application that allows access from both employee and HR administrator. Now, I'm faced with a best practice issue. There would definitely be two users: ...
1
vote
1answer
123 views

ABAC policy formulation and RBAC question

I am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access ...
0
votes
1answer
51 views

Bell-LaPadula no read no write

I'm reading about the Bell-LaPadula model. I understand the Simple Security Property and the Star Property, and I see that the model also incorporates a Discretional Security Property. My question is: ...
21
votes
7answers
3k views

Reading physical memory frame previously owned by another process to read contents of its memory page

I had a conversation with @anger32 who states that zeroing physical memory page frame when passing the page backed by that frame to another process is not the responsibility of OSes like Windows and ...
4
votes
2answers
87 views

Using identifiers in URLs to authenticate users

Someone I know is registered on a community website where they can exchange messages etc. Taking a look at the email notification they receive when something new has been posted, contains an image ...
3
votes
1answer
58 views

Access via link in Email - How can I make this most secure?

I need your professional opinion on this matter, please. The app I'm building has 2 parts: Teachers & students. Teachers use the app to build a project and attach students to it. Then, the ...
5
votes
1answer
104 views

Using a single number instead of an IP address or a DNS name, which are concrete uses? [closed]

My question: I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to ...
0
votes
1answer
69 views

Security concerns for image server?

I am new to the concept of security. I have a simple image server that takes in username and an image to be uploaded. Given a username on a different URL, all images can be viewed as a slide-show on ...
0
votes
1answer
69 views

How to remove Write-Only on 'encrypted USB' from Laptop [closed]

My laptop has been policy enforced to write only on Encrypted USBs like Kingston DataTraveler 4000. Other USBs are read-only and not writable. Are there any tweaks to have this removed. I read one ...
29
votes
4answers
3k views

Can the root user be removed from a *nix system to prevent privilege-escalation?

Once a *nix system is properly configured and hardened, is it a conceivable strategy to remove all super user/root users? Are there benefits to removing root from a system altogether to prevent super-...
5
votes
1answer
111 views

How to grant permission to read a text file to a specific application run by a regular user?

A text file is situated in /opt/somefolder. It contains a pair login - password read by an application when authenticating on a server. The application is run by a regular user, so that the file can ...
1
vote
1answer
70 views

What kind of answer is this textbook question looking for in access control model?

I'm going over a practice question and I have trouble understanding what it's asking. Draw an access control matrix for the following Linux file system. Group A1 contains S1 and S3, group A2 ...
5
votes
1answer
424 views

Mandatory vacation as a security control?

I recently came across the concept of mandatory vacation as a management security control. Employees are forced to take at least one week of consecutive vacation to provide the company to audit their ...
3
votes
2answers
60 views

Where do Access Controls Fit into the Parkerian Hexad?

The security elements of the Parkerian Hexad are: Confidentiality Possession or Control Integrity Authenticity Availability Utility Where do access controls (mandatory, discretionary and ACL) fit ...
0
votes
1answer
122 views

Difference Between MAC and DAC

Are the only difference between DAC and MAC: the fact that MAC can also dictate DAC-type permissions to processes, not just users and name space objects? (files,etc) And there's no concept of ...
5
votes
2answers
308 views

Keeping passwords out of source code

Secrets should not be in source code and in version control because of two reasons: External threat: An attacker can exploit a vulnerability to get access to files/source of your website/application....
2
votes
0answers
51 views

What are the most common ways to Architect the verification process of the access tokens between resource and authentication server using OAUTH 2.0?

What are the most common ways to Architect the verification process of the access tokens between resource server and authentication server using OAUTH 2.0? I am trying to build a web application ...
2
votes
1answer
82 views

Protecting a database against insiders

Consider a network for a web-application with 1 webserver and 1 MySQL database, both on physically different servers and both running Linux. The database stores mission critical data and this data is ...
95
votes
12answers
19k views

Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)

I just got a new job at a medium-sized (~100 employees) company and one of the first things I was told is that I cannot use my own computer, because I need to be able to connect to their network, ...