A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

5
votes
3answers
379 views

How can i deal with management who want 'Domain Admin' access?

While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to ...
10
votes
2answers
2k views

Is there a secure way to have a publicly facing terminal server?

TL;DR We are looking at opening port 3389 for a terminal server all the advice I’ve seen is that its suicidal but without good explanations as to why. Is it really that bad? We are looking at setting ...
2
votes
3answers
158 views

Why are UNIX-like ACLs not a form of MAC

What is the reason for UNIX-like access permissions (both the traditional user-group-others and extended ACLs) being classified as a form of DAC (Discretionary Access Control) system and not MAC ...
-1
votes
1answer
102 views

For a Broker/Dealer, what technology is appropriate to limit transaction to a given state? [closed]

The SEC allows for individuals to not register with them if they don't permit business with users outside of the state: A broker-dealer that conducts all of its business in one state does not ...
2
votes
2answers
2k views

Prevent unauthorized workstations from joining a Windows Domain

Corporate policy only allows users to connect corporate-issued machines to the network managed by Active Directory. Is there some means to log or otherwise detect when the same user account joins the ...
3
votes
3answers
815 views

Using /usr/bin/passwd as login shell

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host. I have set up a separate user account (say 'tunnel') ...
2
votes
3answers
449 views

MySQL database access prevention

I am doing a PHP website for a client who deals with third party financial information, and he is concerned about the developmers (me) having access to all the information, which is obviously a valid ...
3
votes
2answers
114 views

Authorising use of apps from a public store with no back end service

I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
6
votes
4answers
1k views

Safest way for multiple users post to a single social networking account

Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of ...
-1
votes
1answer
105 views

Bringing in an intern

When bringing in an intern to help you in the IT world and with access to servers and client information, what kind of forms should be signed, especially when they work remotely?
4
votes
2answers
499 views

How can the low-water mark property apply to Bell-LaPadula?

I am taking a computer security class, and have a homework problem which has the following setup: Now assume a dynamic version of the Bell-La Padula Confidentiality model that incorporates a ...
2
votes
2answers
345 views

MySQL Access Control?

I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
2
votes
1answer
406 views

OAuth: client credentials vs tokens

Wouldn't it be much simpler and virtually equally secure to replace tokens by pure client credentials? Client credentials wouldn't expire and resource owners would always be able to modify their ...
3
votes
1answer
238 views

Is RDP an effective security barrier

If you need to provide access to a GUI / GUIs in one network from within another network, can RDP (e.g. via Terminal Services) be used as an effective security 'barrier', to stop any other direct ...
4
votes
4answers
165 views

How can an Subject only read and write to its owned objects?

It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our ...
-1
votes
1answer
155 views

setting up website for logged in users, anyone, and files no one should see (via the web) [closed]

I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public ...
1
vote
1answer
245 views

What are the basic implementations that make a network secure from the inside\outside?

Would you consider the following to be "basic hardening items" for network equipment and servers? VLANs Access Control (such as NTFS permissions) Patch Management System Host Firewall Anti-Virus ...
0
votes
1answer
67 views

Relative costs involved in making changes to the current organisational security

I need help understanding what is required by the phrase "a comparison of the relative costs involved in making changes to the current organizational security procedures". Am I to compare the cost ...
20
votes
1answer
104k views

Why can you bypass restricted WiFis by adding “?.jpg” to the URL?

I recently read an article on Hacking a commercial airport WLAN. It's basically about circumventing paid airport WiFi redirections (they redirect you to a certain URL when you type something in the ...
4
votes
3answers
450 views

Live Linux which does not mount any hard drive in the computer

I am searching for a Linux System which runs from a CD and does not mount any hard drive of the computer. I want to prevent any possiblity to write something on the hard drive of the computer and on ...
1
vote
2answers
143 views

Wifi box produces three SSIDs?

While using a friend's wifi, he said I should use his SSID, let's call it XYZ's Wifi. When I started my Macbook Pro, three SSIDs came up. Two were called XYZ's Wifi and the third was called XYZ's ...
-2
votes
5answers
3k views

How can I configure my router to prevent connections bypassing it?

I am trying to configure my router to control access for several of my devices at home. I am currently using a linksys router. Our home consists of three devices (a desktop, a laptop, and a ...
1
vote
2answers
3k views

how safe is a home NAS with ssh access?

I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files. Some extras include: ssh, ftp, telnet, mail servers photo gallery ...
14
votes
5answers
2k views

Comparsion Between AppArmor and Selinux

I was reviewing several different comparison of AppArmor and Selinux which include Why I Like AppArmor More Than SELinux SELinux and AppArmor: An Introductory Comparison From these articles I ...
1
vote
1answer
159 views

How do automated systems store their keys securely?

As with many systems (primarily websites) there are automatic components that run on a server and are not user based (such as crons) that don't have the opportunity for a real person to input a secret ...
1
vote
2answers
150 views

passwords database - access control and/or synchronization

so, we've got a ton of passwords that several different administrators need to have access to, each with their unique password/key/user/whatever... it needs to be either centralized, or the passwords ...
3
votes
3answers
635 views

Access Control and Authentication using Facebook access tokens in a webapp

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create ...
0
votes
1answer
80 views

how to stop write downs

Consider a scenario with two security levels, Alice and Bob. Bob is Alice's boss. Bob must be able to read Alice's documents but not write anything to her documents. I am using encryption keys to ...
-3
votes
3answers
185 views

wireless security concern [closed]

My small office has Netgear Router (N300 DGN2200). I had it secured using "password" . So any computer which needed access had to give the security password. But today a outsider accessed my router ...
0
votes
3answers
270 views

Keyless entry security systems and HIPAA implications

We are upgrading our office to have badged security doors. What I would particularly like to know is if Keyless Entry systems exist or are of decent quality. By this I mean, I would like the doors ...
3
votes
2answers
6k views

How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?

This is what I believe to be an interesting challenge :) A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down ...
3
votes
3answers
2k views

Should I give developers admin rights or leave as power users? [duplicate]

In my organization we are in the process of upgrading everyone to Windows 7.We have all of our users configured as power users. The issue we are running into is this: Should we give developers local ...
0
votes
6answers
345 views

What sort of security method is this called (if it has a name)?

I have thought of a way of securing access to an application interacting with another application. Using this method Application 1 - "What is the sum of 1+1?" Application 2 - "3" Application 1 - ...
0
votes
1answer
99 views

Credentials using AWS IAM

I have a server, which should provide temporary credentials to the client. The credentials will be transmitted using HTTPS. The client should be able to upload S3 files, as well as download them. The ...
1
vote
2answers
429 views

BLP Lattice structure with missing top and bottom levels

I designed a system similar to the above diagram. However There is no (Top Secret, {nuclear,crypto}) and no (Secret,{}) levels. Meaning that there is no top and bottom level. Would it make the BLP ...
4
votes
3answers
333 views

Allow a PA to see a director's emails, but keep some emails private

We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows: Director A wants to send an email to Director B, both director A and ...
0
votes
2answers
462 views

Access control matrix and integrity

Can access control matrix in addition to confidentiality provide the integrity of the objects to which access is being controlled?
17
votes
7answers
1k views

My company policy states I must put all passwords in a password safe shared with management. Is this secure?

As the title says, my company has a policy that all passwords to e.g. our workstations and server logins must be stored in an online safe. I won't say which one but there are some out there you can ...
-1
votes
3answers
465 views

How information in an access log could be used to identify the true identity of an impostor?

Is it possible to use information in an access log to identify the true identity of an impostor who has acquired unauthorized access to a computing system (Perhaps by combining several different ...
2
votes
2answers
1k views

DMZ and LAN data exchange - what direction should connections be made?

When configuring services in the DMZ to exchange data with the internal LAN which scenario would be more secure: DMZ service pushes data to LAN service or LAN service pulls data from DMZ ...
2
votes
5answers
1k views

Security purpose of asking admin password to mount partition on Linux

So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
6
votes
2answers
397 views

Where to put private files on a shared web server

I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot ...
0
votes
3answers
196 views

Using remote desktop

I was having trouble getting Outlook to work with my schools email account and called the help desk. They gave me a link to install a program called Bomgar. I installed it and clicked "allow viewing ...
10
votes
2answers
1k views

Why do some Java APIs bypass standard SecurityManager checks?

In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
3
votes
2answers
1k views

Restrict network access for a single process with SELinux or AppArmor

I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with ...
16
votes
3answers
419 views

Risks of Mullions in High Security Areas

I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
0
votes
1answer
418 views

Standards for physical Access Control systems

Hoping to help protect an IT installation, I've been looking into physical protection systems, specifically Access Control for protected areas. The field is quite big. Are there any US or ...
1
vote
2answers
135 views

Preventing Client PC's from accessing C&C machines

At my office I find us constantly fighting with malware. All users run under the "user" level, we have McAfee and have recently reviewed the Best Practices guide to ensure we adhere to it, all of my ...
3
votes
5answers
291 views

Is there an access-control model defined in terms of application structure?

I'm working on the access control component of a complex web application. One of the goals is to have a strictly defined model for who can do what, but I can't find an existing model that meets our ...
0
votes
1answer
385 views

website hacked and all its content erased despite the protections

i was hacked by a guy who erased everything. I spent the day to put everything in order, and i would like to find a solution for this : he erased all the files, and also changed the title for "www" in ...