A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

learn more… | top users | synonyms

6
votes
2answers
4k views

What are the advantages/disadvantages of attribute-based access control?

An example attribute would be "employee is currently located in the US" and is trying to access a document that requires the person to be accessing the document in US territory.
46
votes
8answers
3k views

I'm an IT consultant. Should I discourage a client from telling me his password?

I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple ...
0
votes
2answers
317 views

File shares from a DMZ into an internal network

We have a firewall policy that prohibits MS RPC through firewall, particularly from internet facing DMZ's back to the internal network. There is a business unit requesting an alternative method to ...
18
votes
3answers
9k views

Router password vs MAC filtering?

I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the ...
4
votes
4answers
6k views

How to prevent restrict access to a web application to authorized devices only?

I have developed an MVC web app. Right now, the client using this app in office area. The client has requested that no one should use this app on any device except the office's PC/tablets. Now ...
1
vote
1answer
71 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
4
votes
4answers
2k views

Block unauthorized user from getting access to intranet

What's the common way to block users from accessing intranet? Right now, whoever plugs in a cable can access any intranet server freely. I want to change this behavior. But given that we run not only ...
0
votes
1answer
558 views

Who to assign read/write access rights for a single-user application to run correctly?

My application installs for a single user on a Windows machine. Any user may install the application for himself, but the application will save some information common to all users in a separate ...
15
votes
6answers
21k views

Is it possible for a hacker to download a php file without executing it first?

I have a php website where everything is in the public_html\ folder, including inclides folder with config and classes. I told my developer to move it away from public folder but he said there is no ...
10
votes
7answers
1k views

Alternative to VPN

We have a network that is completely closed to the outside world. It needs to be. Problem is we need to remote into a server on this network once in a blue moon for diagnostics. We've discussed ways ...
6
votes
2answers
389 views

Full-disk encryption and theft mitigation?

Is it possible to combine the security of full-disk encryption (e.g. Truecrypt) with the honeypot-like performance of anti-theft tools (e.g. Prey)? In other words, is it feasible to have both strong ...
0
votes
2answers
161 views

How to allow only the public key owner to submit requests to my site? And what is this type of security called?

This was probably asked many times here, but I'm not finding any because I'm not sure what to look for. I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
7
votes
1answer
217 views

Using / finding covert channels in inter-process communication

I've got a class exercise that involves a virtual game of Werewolves/Mafia. We're not really taught how to do anything in this class, which makes it hard for everyone to do the labs. The idea is that ...
5
votes
3answers
414 views

How can i deal with management who want 'Domain Admin' access?

While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to ...
11
votes
2answers
2k views

Is there a secure way to have a publicly facing terminal server?

TL;DR We are looking at opening port 3389 for a terminal server all the advice I’ve seen is that its suicidal but without good explanations as to why. Is it really that bad? We are looking at setting ...
2
votes
3answers
168 views

Why are UNIX-like ACLs not a form of MAC

What is the reason for UNIX-like access permissions (both the traditional user-group-others and extended ACLs) being classified as a form of DAC (Discretionary Access Control) system and not MAC ...
-1
votes
1answer
103 views

For a Broker/Dealer, what technology is appropriate to limit transaction to a given state? [closed]

The SEC allows for individuals to not register with them if they don't permit business with users outside of the state: A broker-dealer that conducts all of its business in one state does not ...
2
votes
2answers
2k views

Prevent unauthorized workstations from joining a Windows Domain

Corporate policy only allows users to connect corporate-issued machines to the network managed by Active Directory. Is there some means to log or otherwise detect when the same user account joins the ...
3
votes
3answers
1k views

Using /usr/bin/passwd as login shell

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host. I have set up a separate user account (say 'tunnel') ...
2
votes
3answers
470 views

MySQL database access prevention

I am doing a PHP website for a client who deals with third party financial information, and he is concerned about the developmers (me) having access to all the information, which is obviously a valid ...
3
votes
2answers
116 views

Authorising use of apps from a public store with no back end service

I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
6
votes
4answers
2k views

Safest way for multiple users post to a single social networking account

Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of ...
-1
votes
1answer
108 views

Bringing in an intern

When bringing in an intern to help you in the IT world and with access to servers and client information, what kind of forms should be signed, especially when they work remotely?
4
votes
2answers
573 views

How can the low-water mark property apply to Bell-LaPadula?

I am taking a computer security class, and have a homework problem which has the following setup: Now assume a dynamic version of the Bell-La Padula Confidentiality model that incorporates a ...
2
votes
2answers
405 views

MySQL Access Control?

I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
2
votes
1answer
485 views

OAuth: client credentials vs tokens

Wouldn't it be much simpler and virtually equally secure to replace tokens by pure client credentials? Client credentials wouldn't expire and resource owners would always be able to modify their ...
3
votes
1answer
255 views

Is RDP an effective security barrier

If you need to provide access to a GUI / GUIs in one network from within another network, can RDP (e.g. via Terminal Services) be used as an effective security 'barrier', to stop any other direct ...
4
votes
4answers
169 views

How can an Subject only read and write to its owned objects?

It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our ...
-1
votes
1answer
160 views

setting up website for logged in users, anyone, and files no one should see (via the web) [closed]

I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public ...
1
vote
1answer
284 views

What are the basic implementations that make a network secure from the inside\outside?

Would you consider the following to be "basic hardening items" for network equipment and servers? VLANs Access Control (such as NTFS permissions) Patch Management System Host Firewall Anti-Virus ...
0
votes
1answer
68 views

Relative costs involved in making changes to the current organisational security

I need help understanding what is required by the phrase "a comparison of the relative costs involved in making changes to the current organizational security procedures". Am I to compare the cost ...
28
votes
1answer
138k views

Why can you bypass restricted WiFis by adding “?.jpg” to the URL?

I recently read an article on Hacking a commercial airport WLAN. It's basically about circumventing paid airport WiFi redirections (they redirect you to a certain URL when you type something in the ...
5
votes
3answers
552 views

Live Linux which does not mount any hard drive in the computer

I am searching for a Linux System which runs from a CD and does not mount any hard drive of the computer. I want to prevent any possiblity to write something on the hard drive of the computer and on ...
1
vote
2answers
146 views

Wifi box produces three SSIDs?

While using a friend's wifi, he said I should use his SSID, let's call it XYZ's Wifi. When I started my Macbook Pro, three SSIDs came up. Two were called XYZ's Wifi and the third was called XYZ's ...
-2
votes
5answers
3k views

How can I configure my router to prevent connections bypassing it?

I am trying to configure my router to control access for several of my devices at home. I am currently using a linksys router. Our home consists of three devices (a desktop, a laptop, and a ...
2
votes
4answers
4k views

how safe is a home NAS with ssh access?

I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files. Some extras include: ssh, ftp, telnet, mail servers photo gallery ...
14
votes
5answers
3k views

Comparsion Between AppArmor and Selinux

I was reviewing several different comparison of AppArmor and Selinux which include Why I Like AppArmor More Than SELinux SELinux and AppArmor: An Introductory Comparison From these articles I ...
1
vote
1answer
163 views

How do automated systems store their keys securely?

As with many systems (primarily websites) there are automatic components that run on a server and are not user based (such as crons) that don't have the opportunity for a real person to input a secret ...
1
vote
2answers
158 views

passwords database - access control and/or synchronization

so, we've got a ton of passwords that several different administrators need to have access to, each with their unique password/key/user/whatever... it needs to be either centralized, or the passwords ...
3
votes
3answers
690 views

Access Control and Authentication using Facebook access tokens in a webapp

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create ...
0
votes
1answer
81 views

how to stop write downs

Consider a scenario with two security levels, Alice and Bob. Bob is Alice's boss. Bob must be able to read Alice's documents but not write anything to her documents. I am using encryption keys to ...
-3
votes
3answers
193 views

wireless security concern [closed]

My small office has Netgear Router (N300 DGN2200). I had it secured using "password" . So any computer which needed access had to give the security password. But today a outsider accessed my router ...
0
votes
3answers
292 views

Keyless entry security systems and HIPAA implications

We are upgrading our office to have badged security doors. What I would particularly like to know is if Keyless Entry systems exist or are of decent quality. By this I mean, I would like the doors ...
3
votes
2answers
8k views

How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?

This is what I believe to be an interesting challenge :) A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down ...
3
votes
3answers
2k views

Should I give developers admin rights or leave as power users? [duplicate]

In my organization we are in the process of upgrading everyone to Windows 7.We have all of our users configured as power users. The issue we are running into is this: Should we give developers local ...
0
votes
6answers
349 views

What sort of security method is this called (if it has a name)?

I have thought of a way of securing access to an application interacting with another application. Using this method Application 1 - "What is the sum of 1+1?" Application 2 - "3" Application 1 - ...
0
votes
1answer
104 views

Credentials using AWS IAM

I have a server, which should provide temporary credentials to the client. The credentials will be transmitted using HTTPS. The client should be able to upload S3 files, as well as download them. The ...
1
vote
2answers
484 views

BLP Lattice structure with missing top and bottom levels

I designed a system similar to the above diagram. However There is no (Top Secret, {nuclear,crypto}) and no (Secret,{}) levels. Meaning that there is no top and bottom level. Would it make the BLP ...
4
votes
3answers
403 views

Allow a PA to see a director's emails, but keep some emails private

We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows: Director A wants to send an email to Director B, both director A and ...
0
votes
2answers
499 views

Access control matrix and integrity

Can access control matrix in addition to confidentiality provide the integrity of the objects to which access is being controlled?