A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

2
votes
1answer
4k views

MAC vs DAC vs RBAC

Someone can suggest me a real situation in which is better to use MAC (Mandatory Access Control) instead of DAC (Discretionary Access Control) or RBAC (Role Based Access Control)? And in which DAC is ...
4
votes
5answers
238 views

Can someone please explain RBAC to me?

From http://msdn.microsoft.com/en-us/library/jj709705.aspx In contrast to the DAC model, which is oriented around objects, the AzMan RBAC model attempts to orient the common administrative experience ...
0
votes
3answers
446 views

Securing apache by IP with .htaccess

I have a folder that I don't want to be accessible from outside my network's LAN. It seems like all traffic from the outside world goes through my firewall (192.168.1.39). So I made my .htaccess as ...
0
votes
1answer
293 views

is UPnP / NAT-PMP really necessary today?

The possibility to enable port forwards for any hosts inside the LAN has of course security implications. The problem from my point of view is not that there are bad users, but bad hosts/programs and ...
1
vote
2answers
50 views

Should application logs be available to admins or just superuser?

I'm developing a kind of standard web-application, to be hosted internally on few customer's servers (not a public service, startup or anything like that). A kind of CMS, e-learning platform or ...
1
vote
1answer
419 views

Is a firewall an access control list?

I want to know if a firewall is considered an access control list (ACL). I know there are other types of ACLs, but am specifically interested in knowing if a firewall is an ACL. Edit: It appears ...
1
vote
1answer
137 views

Is open-to-all CORS safe for non-cookie-based authentication schemes (e.g. OAuth)

I'm building an API with both protected and public endpoints, and I'm protecting it with OAuth 2's various flows. I want this API to be open to the world - the main consumer website won't even be on ...
0
votes
3answers
1k views

Prevent a server side script from a direct URL access

There is a server side script written in php(say backend_file.php) or coldfusion(say backend_file.cfm). Lets say, i am using Apache and I have a sample web folder (on my Localhost) like: ...
0
votes
2answers
70 views

How many accounts should I have in an information system?

Is it a problem to have more than one account in an information system from security point of view? Let me clarify a bit. It is a bank system. I wonder if having a CSO (customer service officer) ...
1
vote
1answer
505 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
21
votes
7answers
8k views

If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker? [closed]

In other words, how easy is it to break into Windows without having the passwords for any of the users configured in the computer?
2
votes
1answer
493 views

How can the Google web crawler bypass portals?

This is a situation that I have encountered on a number of occasions. I will conduct a web search in Google, a link to a file (.pdf for example) will take you to that file on the server. It opens up ...
4
votes
1answer
155 views

Car Remote App Security

Car manufactures like BMW, Audi or Mercedes-Benz all provide mobile applications to control your car. All apps share really critical functions like remote lock/unlock or the ability to find your car ...
0
votes
3answers
358 views

What security issues will I face with outsourced VPS server?

Our small comapny wants to launch a paid service, hosted on the outsourced VPS server. The obvious risk is that the machine is physically not in our office and that possibly the database could be ...
1
vote
1answer
85 views

what are security flaws on providing access to users through a unlisted/private/token/signed URL?

Some web applications enable registered users to grant temporal application access to un-registered users sending token/private/unlisted/signed URLs (I ignore the exact terminology for this), which ...
1
vote
0answers
302 views

Since when Access-Control-Allow-Credentials is required?

About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal ...
0
votes
3answers
58 views

Restrict access to admin area by checking SSH connections

Assuming that the users have dynamic IPs (so I can't whitelist) and that setting up a VPN is not an option, is it a valid approach to restrict access to an administration area by only allowing IPs ...
0
votes
2answers
123 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
-3
votes
1answer
322 views

How could an attacker have gained remote access to my laptop? [closed]

I have a 15 yr old daughter who's become not only a certified Microsoft Expert, but by pure accident, it came to my attention she'd long ago created a SPLIT network connection on our internet, HIDDEN ...
-1
votes
2answers
602 views

Is there a difference between Broken Access Control and Insecure Direct Object reference? [closed]

According to me,if this difference is correct,it is that for exploiting a broken access control you don't necessarily need to be logged into the application,but for exploiting insecure direct object ...
6
votes
2answers
2k views

What are best practices for implementing ACL

I have a website that has certain menu items that need to be hidden from end users. The web site has PHP in the front-end and Java and Spring in the back-end, deployed on a Linux OS in a VM ...
6
votes
2answers
1k views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
6
votes
2answers
4k views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
6
votes
3answers
261 views

Is SESAME really used in Europe?

I am looking at a text that mentions that the Secure European System for Applications in a Multi-vendor Environment (SESAME) was designed to address some of Kerberos weakness, with enhancements such ...
2
votes
0answers
817 views

Google ads and/or DoubleClick wants to access the keyboard API in Firefox? [closed]

I have started Firefox in an Ubuntu terminal, and now I see these messages during browsing: "No permission to use the keyboard API for http://googleads.g.doubleclick.net" I mean... WTF? Why does ...
1
vote
0answers
173 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
46
votes
5answers
4k views

How does a country block its citizens from accessing a site?

Following Turkey's recent social site blocks, I am wondering how can you efficiently accomplish that as a country. Similar for a big company. Blocking IPs → easy to circumvent, (proxys, tunnels, ...
3
votes
1answer
2k views

Looking for approach to implement attribute based access control (ABAC)

We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up: Will it lead to significant performance issues? Especially ...
0
votes
2answers
116 views

Anonymizing data for applications

I try to design a system which reads events comming from devices, stores them and exposes API to various applications. Originally I wanted to introduce a module Id translator, so I would store only ...
1
vote
4answers
217 views

Comprehensive audit of firewall - is Internet truly not accessible?

We have many Linux servers in several co-locations over the world. By design, these machines generally should not be able to access the Internet. Depending on location and role, some sites may have ...
0
votes
3answers
427 views

Is a console application with NT Authority/System rights dangerous?

A developer managed to open a console application with NT Authority/System rights at the startup screen before logging in. From that command prompt it is possible to execute arbitrary programs like ...
0
votes
1answer
215 views

Employee Snooping [closed]

I just got hired at this SW tech company with a few IT gurus in it. There is a clever genius that is suspect. He obtained my personal home email address I use. It was obtained from company ...
40
votes
8answers
9k views

Why am I allowed to access protected Windows files when I boot Ubuntu from USB?

How come I'm allowed to reboot a computer that I don't own, put in a USB, boot ubuntu from it and then access all files stored on the drives available (even critical files such as system files on C ...
1
vote
2answers
77 views

user roles or access levels

I am beginning a new project and I already know that I'll have various roles for various users, regardless of their access level. They just have different jobs to do. With that in mind, I'm thinking ...
2
votes
2answers
131 views

RBAC and assertions, which authorization flow is better?

I'd like to ask which authorization flow is considered better or standard. First approach (has role AND assertion is valid): if (!isGranted(roles, permission) { return false; } if ...
1
vote
0answers
519 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
-1
votes
4answers
526 views

what will happen if us government shutdown Tier-1 internet backbone?

what will happen if us government shutdown Tier-1 internet backbone? Although Internet is designed to be quite resilient: Internet BackBone The Internet, and consequently its backbone networks, ...
1
vote
3answers
217 views

Resetting passwords howto

I am currently in the process of designing a registration form for the users to register accounts. The accounts will contain a lot of personal information, so I want to ensure highest possible ...
4
votes
6answers
2k views

Locking IP addresses to try and improve security

(Originally posted on the work place and was suggested to post here) I know being an employee I am paid to do what my boss tells me to do, however: I am currently writing a website for my company ...
1
vote
1answer
95 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
0
votes
1answer
305 views

Difference between password expiration and account expiration [closed]

If a password expires, the user can't access the account. If the account expires, the user can't access the account... So, what's the difference? Just that in the case of an expired account, I'd need ...
0
votes
1answer
1k views

Protecting MYSQL with Fail2Ban? [closed]

I have a bunch Raspberry Pis collecting data from behind client firewalls. I want to start sending this data to MYSQL server. Because the Raspberry Pis do not have static IP addresses, I obviously ...
2
votes
1answer
719 views

Security implications of granting IIS user group folder modify permissions

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group. What are the security implications of granting AppPoolIdentity modify and create ...
1
vote
1answer
279 views

Is a separate server needed for remotely accesing accounting software?

Wishing you all a great 2014. I hope this is the right section. Basically we have a Dell Poweredge R520 server in our office, and we now want to install some accounting software that can be accessed ...
2
votes
1answer
72 views

Preventing softwares from leaving traces in Windows | deleting the traces easily

Say I open a .doc file from my UFD. I want to avoid leaving any traces in Windows (e.g. recent files, back-up files, swaps, etc) , or at least be able to delete all easily. So in this case, I want to ...
1
vote
1answer
161 views

Spoofing and guest network security

I know a little bit about network security but it's only about enough to know there's a lot I don't know. My requirement is to add a 2nd wifi to my current setup (1 wifi emitted by a ...
0
votes
2answers
59 views

Contents retrieved from a not protected url from content owner's server. Legal? [closed]

Is legal to use contents retrieved from a not protected url (no authentication involved, just a public accessible URL) from the content owner's server? Is legal to distribute urls pointing to that ...
1
vote
3answers
743 views

How do I restrict network access to LAN for visitors

How do I restrict network access to LAN for visitors? In my organization's premises any outside visitor can come and connect to the LAN ports in our meeting rooms. We have seen that they are able to ...
1
vote
2answers
292 views

Isolating guest networks

I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network. Initially, I used IP filtering ...
3
votes
3answers
203 views

Governement like classified information system

I need to implement a classification system for my company, similar to the government's. I'm working for a company working with the government. The classification system in my country isn't public so ...