A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.
5
votes
1answer
103 views
Is there a secure way to have a publicly facing terminal server?
TL;DR We are looking at opening port 3389 for a terminal server all the advice I’ve seen is that its suicidal but without good explanations as to why. Is it really that bad?
We are looking at setting ...
5
votes
1answer
819 views
Clark Wilson Integrity Model: Rules
What is the conceptual difference between certification rules and enforcement rules in the Clark Wilson model?
Am I on a wrong path when I assume that certification rules ensure external integrity ...
5
votes
1answer
623 views
Windows mandatory access control: How to remove “mandatory level” label from the file?
1) How to remove "mandatory level" label from the file?
I have two files, for first icalcs return
Mandatory Label\Medium Mandatory Level:(NW)
for second icalcs doesn't return anything (that means ...
5
votes
2answers
808 views
Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?
I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
4
votes
2answers
127 views
Is it correct to consider audits as exclusively “detective” in nature?
I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me. The instructor was discussing access control administration areas and began categorizing certain ...
4
votes
3answers
221 views
Live Linux which does not mount any hard drive in the computer
I am searching for a Linux System which runs from a CD and does not mount any hard drive of the computer.
I want to prevent any possiblity to write something on the hard drive of the computer and on ...
4
votes
3answers
136 views
Allow a PA to see a director's emails, but keep some emails private
We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows:
Director A wants to send an email to Director B, both director A and ...
4
votes
3answers
164 views
(custom software) Security rules on each record when using user-groups per application
I'm working with custom software here, so don't worry about Microsoft whatever, Open anything, or something else. Let’s stick to theory of how this should go together.
Let’s say I have a user ...
4
votes
4answers
111 views
Block unauthorized user from getting access to intranet
What's the common way to block users from accessing intranet?
Right now, whoever plugs in a cable can access any intranet server freely. I want to change this behavior. But given that we run not only ...
4
votes
3answers
171 views
Are there a standard method(s) for me to give someone else read-only access to my data?
Are there a standard method(s) for me to give someone else read-only access to my data?
There are several situations where I may want to give a few people read-only access to some data, but I would ...
4
votes
2answers
140 views
How is the password prompt going to protect me from ruining my computer?
On Unix based systems, I'm often prompted to enter my password before installing or running a program.
Why does this protect me?
If I'm running a kiosk, I understand that a password might prevent ...
4
votes
2answers
177 views
How can the low-water mark property apply to Bell-LaPadula?
I am taking a computer security class, and have a homework problem which has the following setup:
Now assume a dynamic version of the Bell-La Padula Confidentiality
model that incorporates a ...
4
votes
1answer
438 views
Is it correct to consider Task Based Access Control as a type of RBAC?
I'm studying for CISSP certification and one of the video lectures I viewed (CBT Nuggets) really confused me. Here are some excerpts from the lecture:
"Role Based Access Control doesn't
...
4
votes
3answers
117 views
How can an Subject only read and write to its owned objects?
It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our ...
3
votes
4answers
243 views
Help to account all the points of physical access to a rack server to steal software
Let's say I want to move my 1U Dell server to co-location site with a hostile company who will try to steal my code (this is almost 90% probability if I dont take steps)...
The limitation for their ...
3
votes
3answers
971 views
How can reverse proxies be used to bypass acceptable use policies of a company?
I am wondering how reverse proxies can be used to bypass company acceptable use policies?
What can be done to prevent it?
3
votes
3answers
242 views
How do I clearly distinguish between groups of formal and informal models?
I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
3
votes
3answers
435 views
Should I give developers admin rights or leave as power users? [duplicate]
In my organization we are in the process of upgrading everyone to Windows 7.We have all of our users configured as power users. The issue we are running into is this:
Should we give developers local ...
3
votes
3answers
198 views
Using /usr/bin/passwd as login shell
I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host.
I have set up a separate user account (say 'tunnel') ...
3
votes
2answers
93 views
Authorising use of apps from a public store with no back end service
I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
3
votes
1answer
498 views
Covert Channels Exploit and the Bell-LaPadula MAC Model
I'm wrapping my head around Mandatory Access Control (MAC) and the well-known Bell-LaPadula model. One limitation that is mentioned with this model is covert channel exploitation. The one example I ...
3
votes
2answers
176 views
Which access rights should be chosen for doku wiki?
I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages).
At the moment I gave the ...
3
votes
4answers
69 views
How to prevent restrict access to a web application to authorized devices only?
I have developed an MVC web app.
Right now, the client using this app in office area.
The client has requested that no one should use this app on any device except the office's PC/tablets.
Now ...
3
votes
3answers
239 views
Access Control and Authentication using Facebook access tokens in a webapp
I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create ...
3
votes
1answer
602 views
I'm using a Cisco ASA as a VPN endpoint. Where do the VPN clients get firewalled?
(Is this too application specific? It seems like a reasonable question that would be useful to other people...)
So, I've got this ASA in front of a network that I didn't set up. It's been ...
3
votes
2answers
2k views
Better techniques than url parameter encryption
I'm a programmer working on an application where the only choice/vs/deadline was to implement symmetric encryption on url parameter values. The data is insensitive in nature, but we needed to prevent ...
3
votes
2answers
108 views
Vertical information portal security with a customized web browser
I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP).
In my research I have found that by developing a custom lean web browser and installing it on the clients ...
3
votes
1answer
381 views
Securing sensitive data in a DB,is using H2 worth it?
I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now ofc besides the usual pwd hashing + salt +.... I was thinking ...
3
votes
1answer
929 views
Wireless MAC Address Filtering - Authentication/Association
Can somebody explain to me how a wireless AP denies access to the network if the client does not have the correct MAC Address.
Does it not send a probe response when a client has not got a correct ...
3
votes
1answer
134 views
Is RDP an effective security barrier
If you need to provide access to a GUI / GUIs in one network from within another network, can RDP (e.g. via Terminal Services) be used as an effective security 'barrier', to stop any other direct ...
3
votes
1answer
512 views
How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?
This is what I believe to be an interesting challenge :)
A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down ...
3
votes
1answer
253 views
Trial version security
I am developing stand-alone software in BDS 2006. I want to provide a trial version for 6 months -- the user can use it for just 6 months, but no more on a particular system.
I have handled most ...
2
votes
3answers
149 views
Remote Connection Tampering
My small high street laptop repair/service/maintenance shop has been up and running for about 3 years. It's doing quite well so I'm looking to expand into other areas of the PC market.
One area I ...
2
votes
3answers
98 views
Why are UNIX-like ACLs not a form of MAC
What is the reason for UNIX-like access permissions (both the traditional user-group-others and extended ACLs) being classified as a form of DAC (Discretionary Access Control) system and not MAC ...
2
votes
2answers
140 views
Prevent unauthorized workstations from joining a Windows Domain
Corporate policy only allows users to connect corporate-issued machines to the network managed by Active Directory. Is there some means to log or otherwise detect when the same user account joins the ...
2
votes
1answer
177 views
Does this htaccess snippet provide sufficient security?
I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of ...
2
votes
3answers
408 views
Do you give local administrator account password to notebook users?
My notebook users need to travel a lot.
Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings.
Should I give them local administrator's ...
2
votes
4answers
144 views
Is there an access-control model defined in terms of application structure?
I'm working on the access control component of a complex web application. One of the goals is to have a strictly defined model for who can do what, but I can't find an existing model that meets our ...
2
votes
2answers
123 views
MySQL Access Control?
I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
2
votes
5answers
457 views
Security purpose of asking admin password to mount partition on Linux
So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
2
votes
2answers
425 views
Restrict network access for a single process with SELinux or AppArmor
I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with ...
2
votes
1answer
395 views
Putting the Biba-LaPadula Mandatory Access Control Methods to Practise?
Text books on database systems always refer to the two Mandatory Access Control models; Biba for the Integrity objective and Bell-LaPadula for the Secrecy or Confidentiality objective.
Text books ...
2
votes
3answers
128 views
MySQL database access prevention
I am doing a PHP website for a client who deals with third party financial information, and he is concerned about the developmers (me) having access to all the information, which is obviously a valid ...
2
votes
1answer
169 views
OAuth: client credentials vs tokens
Wouldn't it be much simpler and virtually equally secure to replace tokens by pure client credentials?
Client credentials wouldn't expire and resource owners would always be able to modify their ...
2
votes
2answers
354 views
DMZ and LAN data exchange - what direction should connections be made?
When configuring services in the DMZ to exchange data with the internal LAN which scenario would be more secure:
DMZ service pushes data to LAN service
or
LAN service pulls data from DMZ ...
2
votes
2answers
445 views
How to use 'key material' so that multiple people can access protected files?
I'm not sure if this is the right SE to ask this question, but it seems more I have a database of files that needs to be encrypted such that multiple people with different passwords/logins to this ...
2
votes
2answers
109 views
Preventing Client PC's from accessing C&C machines
At my office I find us constantly fighting with malware. All users run under the "user" level, we have McAfee and have recently reviewed the Best Practices guide to ensure we adhere to it, all of my ...
2
votes
1answer
1k views
BLP Lattice-structered system from Access Control Matrix
I've been reading a Computer Security book by Walliam Stallings and have found this example:
http://i.imgur.com/5CAlc.png
of an Access Control Matrix. Any example will do I just thought I'd screenshot ...
2
votes
1answer
38 views
Access Flags for Handles
The handles window in process Explorer has a column Access which supposedly determines the access rights of that particular handle. I am not able to get any documentation on how to read the flags and ...
2
votes
1answer
206 views
Combining capability-based access control with SAML
I have been looking into various research on identity, PKI and access control trying to boil it down to a simplifies methodology for IAM.
One thing which pops up in lots of places is capability-based ...
