A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.
-1
votes
3answers
147 views
How information in an access log could be used to identify the true identity of an impostor?
Is it possible to use information in an access log to identify the true identity of an impostor who has acquired unauthorized access to a computing system (Perhaps by combining several different ...
2
votes
2answers
356 views
DMZ and LAN data exchange - what direction should connections be made?
When configuring services in the DMZ to exchange data with the internal LAN which scenario would be more secure:
DMZ service pushes data to LAN service
or
LAN service pulls data from DMZ ...
2
votes
5answers
462 views
Security purpose of asking admin password to mount partition on Linux
So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
6
votes
2answers
201 views
Where to put private files on a shared web server
I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot ...
0
votes
3answers
155 views
Using remote desktop
I was having trouble getting Outlook to work with my schools email account and called the help desk. They gave me a link to install a program called Bomgar. I installed it and clicked "allow viewing ...
8
votes
2answers
503 views
Why do some Java APIs bypass standard SecurityManager checks?
In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
2
votes
2answers
433 views
Restrict network access for a single process with SELinux or AppArmor
I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with ...
13
votes
3answers
250 views
Risks of Mullions in High Security Areas
I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
0
votes
1answer
211 views
Standards for physical Access Control systems
Hoping to help protect an IT installation, I've been looking into physical protection systems, specifically Access Control for protected areas. The field is quite big. Are there any US or ...
2
votes
2answers
109 views
Preventing Client PC's from accessing C&C machines
At my office I find us constantly fighting with malware. All users run under the "user" level, we have McAfee and have recently reviewed the Best Practices guide to ensure we adhere to it, all of my ...
2
votes
4answers
145 views
Is there an access-control model defined in terms of application structure?
I'm working on the access control component of a complex web application. One of the goals is to have a strictly defined model for who can do what, but I can't find an existing model that meets our ...
0
votes
1answer
263 views
website hacked and all its content erased despite the protections
i was hacked by a guy who erased everything. I spent the day to put everything in order, and i would like to find a solution for this : he erased all the files, and also changed the title for "www" in ...
2
votes
1answer
38 views
Access Flags for Handles
The handles window in process Explorer has a column Access which supposedly determines the access rights of that particular handle. I am not able to get any documentation on how to read the flags and ...
3
votes
2answers
2k views
Better techniques than url parameter encryption
I'm a programmer working on an application where the only choice/vs/deadline was to implement symmetric encryption on url parameter values. The data is insensitive in nature, but we needed to prevent ...
1
vote
1answer
239 views
How secure is github's whitelisting CORS domains?
The Github API allows you to make requests using CORS [1]. The CORS requests are only allowed by certain whitelisted domains :
Any domain that is registered as an OAuth Application is accepted.
...
1
vote
2answers
132 views
Closing handles of a process as a regular user
Here's the situation: As an adminstrator, I am able to stall the application by closing 2 handles held by the process. (Using ProcExplorer) . Is there any way/hack I can use to close file handles ...
6
votes
3answers
319 views
Is it advisable to have a web browser remember login credentials?
I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
1
vote
1answer
165 views
IPtables - Accept Arbitrary Packets
I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by ...
3
votes
3answers
973 views
How can reverse proxies be used to bypass acceptable use policies of a company?
I am wondering how reverse proxies can be used to bypass company acceptable use policies?
What can be done to prevent it?
1
vote
1answer
170 views
Installing applications with different user accounts on linux
I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a ...
3
votes
2answers
108 views
Vertical information portal security with a customized web browser
I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP).
In my research I have found that by developing a custom lean web browser and installing it on the clients ...
4
votes
3answers
173 views
Are there a standard method(s) for me to give someone else read-only access to my data?
Are there a standard method(s) for me to give someone else read-only access to my data?
There are several situations where I may want to give a few people read-only access to some data, but I would ...
2
votes
2answers
445 views
How to use 'key material' so that multiple people can access protected files?
I'm not sure if this is the right SE to ask this question, but it seems more I have a database of files that needs to be encrypted such that multiple people with different passwords/logins to this ...
39
votes
9answers
4k views
Risks of giving developers admin rights to their own PCs
I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
7
votes
2answers
602 views
What is the procedure to follow against a security breach?
Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information.
One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
2
votes
1answer
398 views
Putting the Biba-LaPadula Mandatory Access Control Methods to Practise?
Text books on database systems always refer to the two Mandatory Access Control models; Biba for the Integrity objective and Bell-LaPadula for the Secrecy or Confidentiality objective.
Text books ...
3
votes
1answer
499 views
Covert Channels Exploit and the Bell-LaPadula MAC Model
I'm wrapping my head around Mandatory Access Control (MAC) and the well-known Bell-LaPadula model. One limitation that is mentioned with this model is covert channel exploitation. The one example I ...
0
votes
1answer
89 views
Implementation of a FREE web filter [closed]
I just want some advice for the implementation of a web filter for a school network. Just want to block some contents and url. A free tool should be fine I guess.
Any recommendations?
Thanks!
3
votes
1answer
253 views
Trial version security
I am developing stand-alone software in BDS 2006. I want to provide a trial version for 6 months -- the user can use it for just 6 months, but no more on a particular system.
I have handled most ...
1
vote
3answers
943 views
How to set password on applications in Mac OS to prevent an administrator to start them?
Is there any program that can set password on the app like mail or browser? I know about parent control, but I doesn't work with administrator account.
What I want is some program that blocks some ...
0
votes
1answer
96 views
Best practice for selective opening of ports on network gateway
Our network is currently isolated from the outside by a Linux box, running iptables and Squid to control web access.
By default we deny all outgoing traffic from all IP's, to force Web traffic ...
2
votes
1answer
206 views
Combining capability-based access control with SAML
I have been looking into various research on identity, PKI and access control trying to boil it down to a simplifies methodology for IAM.
One thing which pops up in lots of places is capability-based ...
2
votes
3answers
408 views
Do you give local administrator account password to notebook users?
My notebook users need to travel a lot.
Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings.
Should I give them local administrator's ...
6
votes
6answers
360 views
Disable internet access of development PC for security
My friend's company is trying to disable Internet access of programmer's primary development PC to improve security, while giving them another PC to connect to the Internet. He is a web programmer. I ...
3
votes
4answers
244 views
Help to account all the points of physical access to a rack server to steal software
Let's say I want to move my 1U Dell server to co-location site with a hostile company who will try to steal my code (this is almost 90% probability if I dont take steps)...
The limitation for their ...
8
votes
3answers
811 views
Role Based Access Control + Data Ownership based permissions
Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership?
For example:
Bob is a doctor and has the role ...
0
votes
1answer
664 views
Juniper SRX210, how to make port forwarding work? [closed]
I have a PC 192.168.1.151 which needs 554 and 9001 publicly available. So I used the following configuration but it does not work. Can anyone see my mistake ?
version 10.0R3.10;
system {
...
1
vote
0answers
152 views
What is the best way to manage temporary accounts on Active Directory [closed]
The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
2
votes
1answer
90 views
User Account Notification under Windows useful at all?
IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...
2
votes
1answer
177 views
Does this htaccess snippet provide sufficient security?
I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of ...
5
votes
4answers
1k views
Two SSIDs on same Access point- not good?
If I were to offer two networks (one for trusted users and one to visitors) on one physical access point, is this dangerous because a visitor could compromise the trusted network across via the ...
3
votes
1answer
936 views
Wireless MAC Address Filtering - Authentication/Association
Can somebody explain to me how a wireless AP denies access to the network if the client does not have the correct MAC Address.
Does it not send a probe response when a client has not got a correct ...
5
votes
2answers
810 views
Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?
I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
27
votes
19answers
2k views
How can I prevent my kids from bypassing my computer restrictions?
My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions:
Can this damage my computer or corrupt my files? (I have lots of pictures)
Is ...
1
vote
1answer
158 views
Can HIPS software practically be considered a form of MAC
Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system.
Given that with the use ...
7
votes
5answers
432 views
What is the practical difference between MAC and Capabilities
Both Mandatory Access Controls and Capabilities allow for fine grained privileges to be assigned to applications irrespective or in place of privileges inherited by the running user.
Is there any ...
6
votes
2answers
445 views
How do I log everything a certain program is doing?
i have a program which is pretty simple.
Its just a simple login form.
Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
8
votes
1answer
462 views
Best practices for implementation of role-based access control in healthcare applications
Amongst the open source EMRs, which ones may be good to learn from? Any references I can go to as a starting point?
1
vote
2answers
273 views
Star property in read/write access
The * star property requirement for append access [SC(S) <= SC(O)] is looser than for write access [SC(S) = SC(O)]. Can someone explain the reason for this?
5
votes
3answers
1k views
Bell-LaPadula imlementation example
I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example.
I understand how the model works, but I have difficulties implementing it in a programming language ...
